summaryrefslogtreecommitdiff
path: root/sql
Commit message (Collapse)AuthorAgeFilesLines
* BUG#14629727: USER_VAR_EVENT IS MISSING RANGE CHECKSNuno Carvalho2012-10-212-9/+16
| | | | | Moved explicit instantiation of available_buffer and valid_buffer_range template functions to sql/log_event.cc.
* BUG#14629727: USER_VAR_EVENT IS MISSING RANGE CHECKSNuno Carvalho2012-10-213-7/+86
|\ | | | | | | Merge bundle on mysql-5.1.
| * BUG#14629727: USER_VAR_EVENT IS MISSING RANGE CHECKSNuno Carvalho2012-10-123-7/+86
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This bug had two problems: P1) Reads out of bounds; P2) Writes out of bounds. PROBLEM P1 ---------- User_var_log_event unmarshalling from binlog was not performing range checks when using name_len and val_len variables to walk on event buffer. Added range checks to User_var_log_event unmarshalling to prevent unmarshalling errors. PROBLEM P2 ---------- User_var_log_event value was allocated on thread stack, what caused stack frame errors when User_var_log_event value was bigger than thread stack size. Currently value is allocated on heap memory.
* | Bug#13726751 - 8 BYTE MEMORY LEAK IN DO_SAVE_BLOBNeeraj Bisht2012-10-181-7/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Problem:- When we execute a query which has subquery with GROUP BY, ORDER BY and have a BLOB column,results a memory leak. Analysis:- In case of subquery, which have GROUP BY on BLOB and a ORDER BY on other field and BLOB is not a key. We allocate a tmp buffer to copy_field to take care of BLOB value.This copy_field value can have copies of its in two join(objects), so while freeing this copy_field we have to take care that it is not deleted twice. The double deletion of tmp_table_param.copy_field is handled by two patches. One by Kostja : revid:sp1r-konstantin@mysql.com-20050627101056-55153 Fix the broken test suite in -debug build. and other by Oleksandr revid:sp1r-bell@sanja.is.com.ua-20060118114857-19905 Excluded posibility of tmp_table_param.copy_field double deletion (BUG#14851). both of this patches are commited in different branch and while merging they both get placed,but there is no need for Kostja patch as Oleksandr patch handle this. sql/sql_select.cc: Bug13726751, tmp_join clean up is not necessary as later in the code we are taking care of cleaning up of tmp_join copy_field.
* | Bug#11745891 - LAST_INSERT(ID) DOES NOT SUPPORT BIGINT UNSIGNEDNeeraj Bisht2012-10-162-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Problem:- using last_insert_id() on an auto_incremented bigint unsigned does not work for values which are greater than max-bigint-signed. Analysis:- last_insert_id() returns the first auto_incremented value for a column and an auto_incremented value can have only positive values. In our code, when we are initializing a last_insert_id object, we are taking it as a signed BIGINT, So when the auto_incremented value reaches greater than max signed bigint, last_insert_id gives negative result. Solution: When we are fetching the value from last_insert_id, We are setting the unsigned_flag, so that it take only unsigned BIGINT value. sql/item_func.cc: here unsigned value is converted to signed value. sql/item_func.h: last_insert_id() gives an auto_incremented value which can be positive only,so defined it as a unsigned longlong sets the unsigned_flag to 1.
* | Bug#14629232 SECURITY VULNERABILITY WITH SHOW PROFILEMarc Alff2012-10-122-12/+23
|/ | | | | | | This fix resolves a security vulnerability of SHOW PROFILE. See the bug report for details.
* Bug#14683676 ENDLESS MEMORY CONSUMPTION IN SETUP_REF_ARRAY WITH MAX IN SUBQUERYTor Didriksen2012-10-011-0/+1
| | | | | | | | | | n_child_sum_items kept increasing. Since it is used for calculating the size of ref_pointer_array, we will allocate larger and larger chunks of memory, until we hit some operating system limit. The memory is free()d at disconnect, but is most likely *not* returned to the operating system.
* BackportTor Didriksen2012-09-251-1/+20
| | | | | | Bug #11764313 57135: CRASH IN ITEM_FUNC_CASE::FIND_ITEM WITH CASE WHEN Bug #11764818 57692: Crash in item_func_in::val_int() with ZEROFILL
* Bug#14621627 THREAD CACHE IS UNFAIRJon Olav Hauglid2012-09-251-1/+1
| | | | | | | | | | | | | | | | | | | | | When a client connects to a MySQL server, first a THD object is created. If there are any idle server threads waiting, the THD object is then added to a list and a server thread is woken up. This thread then retrieves the THD object from the list and starts executing. The problem was that this list of THD objects waiting for a server thread, was not working in a FIFO fashion, but rather LIFO. This is unfair, as it means that the last THD added (=last client connected) will be assigned a server thread first. Note however that for this to be a problem, several clients must be able to connect and have THD objects constructed before any server threads manages to be woken up. This is not a very likely scenario. This patch fixes the problem by changing the THD list to work FIFO rather than LIFO. This is the 5.1/5.5 version of the patch.
* BUG#13864642: DROP/CREATE USER BEHAVING ODDLY Raghav Kapoor2012-09-251-89/+146
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | BACKGROUND: In certain situations DROP USER fails to remove all privileges belonging to user being dropped from in-memory structures. Current workaround is to do DROP USER twice in scenario below OR doing FLUSH PRIVILEGES after doing DROP USER. ANALYSIS: In MySQL, When we grant some stored routines privileges to a user they are stored in their respective hash. When doing DROP USER all the stored routine privilege entries associated with that user has to be deleted from its respective hash. The root cause for this bug is some entries from the hash are not getting deleted. The problem is that code that deletes entries from the hash tries to do so while iterating over it, without taking enough measures to address the fact that such deletion can reshuffle elements in the hash. If the user/administrator creates the same user again he is thrown an error 'Error 1396 ER_CANNOT_USER' from MySQL. This prompts the user to either do FLUSH PRIVILEGES or do DROP USER again. This behaviour is not desirable as it is a workaround and does not solves the problem mentioned above. FIX: This bug is fixed by introducing a dynamic array to store the pointersto all stored routine privilege objects that either have to be deleted or updated. This is done in 3 steps. Step 1: Fetching the element from the hash and checking whether it is to be deleted or updated. Step 2: Storing the pointer to that privilege object in dynamic array. Step 3: Traversing the dynamic array to perform the appropriate action either delete or update. This is a much cleaner way to delete or update the privilege entries associated with some user and solves the problem mentioned above. Also the code has been refactored a bit by introducing an enum instead of hard coded numbers used for respective dynamic arrays and hashes in handle_grant_struct() function.
* BUG#14548159: Followup patch to fix some issues on PB2Rohit Kalhans2012-09-232-3/+4
|
* BUG#14548159: NUMEROUS CASES OF INCORRECT IDENTIFIERRohit Kalhans2012-09-2211-130/+300
| | | | | | | | | | | QUOTING IN REPLICATION Problem: Misquoting or unquoted identifiers may lead to incorrect statements to be logged to the binary log. Fix: we use specialized functions to append quoted identifiers in the statements generated by the server.
* Bug#11753779: MAX_CONNECT_ERRORS WORKS ONLY WHEN 1STHarin Vadodaria2012-09-172-8/+69
| | | | | | | | | | | | | INC_HOST_ERRORS() IS CALLED. Issue : Sequence of calling inc_host_errors() and reset_host_errors() required some changes in order to maintain correct connection error count. Solution : Call to reset_host_errors() is shifted to a location after which no calls to inc_host_errors() are made.
* Bug#11750014:ASSERTION TRX_DATA->EMPTY() IN BINLOG_CLOSE_CONNECTIONSujatha Sivakumar2012-09-171-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Problem: ======= trx_data->empty() assert happens at `binlog_close_connection' Analysis: ======== trx_data->empty() function checks for no pending events and the transaction cache to be empty.This function returns "true" if no pending events are present and cache is empty. Otherwise it returns false. `binlog_close_connection' call expects the above function to return true. But if the return value is false then assert is raised. This bug was reproducible in a diskfull scenario. In this disk full scenario try to do an insert operation so that a new pending event is created and flushing this pending event fails. Due to this failure the server goes down and invokes `binlog_close_connection' for clean closure. Since the pending event still remains the assert is caused. This assert is caused only in non transactional databases. Fix: === In a disk full scenario when the insertion fails the transaction is rolled back and `binlog_end_trans` is called to flush the pending events. But flush operation fails as the disk is full and the function simply returns `1' without taking any action to delete the pending event. This leaves the event to remain till the closure of connection. `delete pending' statement has been added to do the required clean up action. sql/log.cc: Added "delete pending" statement to clean pending event
* Backport Bug#13724099Tor Didriksen2012-09-122-7/+21
|
* Bug#14597605 Issue with Null-value user on slaveAndrei Elkin2012-09-101-1/+1
| | | | | | | | | | An "orthographic" typo in User_var::set_deferred() was made in fixes for bug@14275000. While editing the signature of the initial patch to remove the only argument, the assigned value of the argument remained in the body ... to be successfully compiled (!) thanks to names coincidence: the arg to User_var method and its member. Fixed with correcting the typo.
* Bug#13734987 MEMORY LEAK WITH I_S/SHOW AND VIEWS WITH SUBQUERYTor Didriksen2012-09-051-2/+3
| | | | | | | | | In fill_schema_table_by_open(): free item list before restoring active arena. sql/sql_show.cc: Replaced i_s_arena.free_items with DBUG_ASSERT(i_s_arena.free_list == NULL) (there's nothing to free in that list)
* Bug#13025132 - PARTITIONS USE TOO MUCH MEMORYMattias Jonsson2012-08-201-1/+1
| | | | pre-push fix, removed unused variable.
* mergeMattias Jonsson2012-08-202-53/+92
|\
| * Bug#13025132 - PARTITIONS USE TOO MUCH MEMORYMattias Jonsson2012-08-172-35/+13
| | | | | | | | | | | | | | | | | | | | | | Additional patch to remove the part_id -> ref_buffer offset. The partitioning id and the associate record buffer can be found without having to calculate it. By initializing it for each used partition, and then reuse the key-buffer from the queue, it is not needed to have such map.
| * Bug#13025132 - PARTITIONS USE TOO MUCH MEMORYMattias Jonsson2012-08-152-39/+100
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The buffer for the current read row from each partition (m_ordered_rec_buffer) used for sorted reads was allocated on open and freed when the ha_partition handler was closed or destroyed. For tables with many partitions and big records this could take up too much valuable memory. Solution is to only allocate the memory when it is needed and free it when nolonger needed. I.e. allocate it in index_init and free it in index_end (and to handle failures also free it on reset, close etc.) Also only allocating needed memory, according to partitioning pruning. Manually tested that it does not use as much memory and releases it after queries.
* | Backporting Bug 14100466 from 5.6.Alexander Barkov2012-08-172-5/+14
|/
* Bug#13596613:SHOW SLAVE STATUS GIVES WRONG OUTPUT WITHSujatha Sivakumar2012-08-141-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | MASTER-MASTER AND USING SET USE Problem: ======= In a master-master set-up, a master can show a wrong 'SHOW SLAVE STATUS' output. Requirements: - master-master - log_slave_updates This is caused when using SET user-variables and then using it to perform writes. From then on the master that performed the insert will have a SHOW SLAVE STATUS that is wrong and it will never get updated until a write happens on the other master. On"Master A" the "exec_master_log_pos" is not getting updated. Analysis: ======== Slave receives a "User_var" event from the master and after applying the event, when "log_slave_updates" option is enabled the slave tries to write this applied event into its own binary log. At the time of writing this event the slave should use the "originating server-id". But in the above case the sever always logs the "user var events" by using its global server-id. Due to this in a "master-master" replication when the event comes back to the originating server the "User_var_event" doesn't get skipped. "User_var_events" are context based events and they always follow with a query event which marks their end of group. Due to the above mentioned problem with "User_var_event" logging the "User_var_event" never gets skipped where as its corresponding "query_event" gets skipped. Hence the "User_var" event always waits for the next "query event" and the "Exec_master_log_position" does not get updated properly. Fix: === `MYSQL_BIN_LOG::write' function is used to write events into binary log. Within this function a new object for "User_var_log_event" is created and this new object is used to write the "User_var" event in the binlog. "User var" event is inherited from "Log_event". This "Log_event" has different overloaded constructors. When a "THD" object is present "Log_event(thd,...)" constructor should be used to initialise the objects and in the absence of a valid "THD" object "Log_event()" minimal constructor should be used. In the above mentioned problem always default minimal constructor was used which is incorrect. This minimal constructor is replaced with "Log_event(thd,...)". sql/log_event.h: Replaced the default constructor with another constructor which takes "THD" object as an argument.
* Bug #14409015 MEMORY LEAK WHEN REFERENCING OUTER FIELD IN HAVINGSergey Glukhov2012-08-093-6/+7
| | | | | | | | | | | | | When resolving outer fields, Item_field::fix_outer_fields() creates new Item_refs for each execution of a prepared statement, so these must be allocated in the runtime memroot. The memroot switching before resolving JOIN::having causes these to be allocated in the statement root, leaking memory for each PS execution. sql/item_subselect.cc: addon, fix for 11829691, item could be created in runtime memroot, so we need to use real_item instead.
* Merge from mysql-5.1.65-releaseSunanda Menon2012-08-091-2/+1
|\
| * Merge unpushed changes from 5.1.64-releaseBjorn Munch2012-07-121-2/+1
| |\
| | * Solve a linkage problem with "libmysqld" on several Solaris platforms:Kent Boortz2012-06-261-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | a multiple definition of 'THD::clear_error()' in (at least) libmysqld.a(lib_sql.o) and libmysqld.a(libfederated_a-ha_federated.o). Patch provided by Ramil Kalimullin.
| | * Fixing wrong comment syntax (discovered by Kent)Joerg Bruehe2012-06-211-1/+1
| | |
* | | Bug#13928675 MYSQL CLIENT COPYRIGHT NOTICE MUSTNirbhay Choubey2012-08-072-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | SHOW 2012 INSTEAD OF 2011 * Added a new macro to hold the current year : COPYRIGHT_NOTICE_CURRENT_YEAR * Modified ORACLE_WELCOME_COPYRIGHT_NOTICE macro to take the initial year as parameter and pick current year from the above mentioned macro.
* | | Bug #14099846: EXPORT_SET CRASHES DUE TO OVERALLOCATION OF MEMORYChaithra Gopalareddy2012-08-051-17/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | Backport the fix from 5.6 to 5.1 Base bug number : 11765562 sql/item_strfunc.cc: In Item_func_export_set::val_str, verify that the size of the end result is within reasonable bounds.
* | | Bug#14111180 HANDLE_FATAL_SIGNAL IN PTR_COMPARE_1 / QUEUE_INSERTTor Didriksen2012-07-271-3/+2
| | | | | | | | | | | | | | | Space available for merging was calculated incorrectly.
* | | BUG#13868860 - LIMIT '5' IS EXECUTED WITHOUT ERROR WHEN '5' Praveenkumar Hulakund2012-07-261-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | IS PLACE HOLDER AND USE SERVER-SIDE Analysis: LIMIT always takes nonnegative integer constant values. http://dev.mysql.com/doc/refman/5.6/en/select.html So parsing of value '5' for LIMIT in SELECT fails. But, within prepared statement, LIMIT parameters can be specified using '?' markers. Value for the parameter can be supplied while executing the prepared statement. Passing string values, float or double value for LIMIT works well from CLI. Because, while setting the value for the parameters from the variable list (added using SET), if the value is for parameter LIMIT then its converted to integer value. But, when prepared statement is executed from the other interfaces as J connectors, or C applications etc. The value for the parameters are sent to the server with execute command. Each item in log has value and the data TYPE. So, While setting parameter value from this log, value is set to all the parameters with the same data type as passed. But here logic to convert value to integer type if its for LIMIT parameter is missing. Because of this,string '5' is set to LIMIT. And the same is logged into the binlog file too. Fix: When executing prepared statement having parameter for CLI it worked fine, as the value set for the parameter is converted to integer. And this failed in other interfaces as J connector,C Applications etc as this conversion is missing. So, as a fix added check while setting value for the parameters. If the parameter is for LIMIT value then its converted to integer value.
* | | Backport of Bug#14171740 65562: STRING::SHRINK SHOULD BE A NO-OP WHEN ALLOCED=0Tor Didriksen2012-07-261-3/+7
| | |
* | | Fixing wrong copyright. Index.xml was modified in 2005,Alexander Barkov2012-07-241-1/+1
| | | | | | | | | | | | | | | while the copyright notice still mentioned 2003.
* | | Bug#11762052: 54599: BUG IN QUERY PLANNER ON QUERIES WITHChaithra Gopalareddy2012-07-181-2/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | "ORDER BY" AND "LIMIT BY" CLAUSE PROBLEM: When a 'limit' clause is specified in a query along with group by and order by, optimizer chooses wrong index there by examining more number of rows than required. However without the 'limit' clause, optimizer chooses the right index. ANALYSIS: With respect to the query specified, range optimizer chooses the first index as there is a range present ( on 'a'). Optimizer then checks for an index which would give records in sorted order for the 'group by' clause. While checking chooses the second index (on 'c,b,a') based on the 'limit' specified and the selectivity of 'quick_condition_rows' (number of rows present in the range) in 'test_if_skip_sort_order' function. But, it fails to consider that an order by clause on a different column will result in scanning the entire index and hence the estimated number of rows calculated above are wrong (which results in choosing the second index). FIX: Do not enforce the 'limit' clause in the call to 'test_if_skip_sort_order' if we are creating a temporary table. Creation of temporary table indicates that there would be more post-processing and hence will need all the rows. This fix is backported from 5.6. This problem is fixed in 5.6 as part of changes for work log #5558 mysql-test/r/subselect.result: Changes for Bug#11762052 results in the correct number of rows. sql/sql_select.cc: Do not pass the actual 'limit' value if 'need_tmp' is true.
* | | Bug #11765218 58157: INNODB LOCKS AN UNMATCHED ROW EVEN THOUGH USINGAnnamalai Gurusami2012-07-121-2/+27
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | RBR AND RC Description: When scanning and locking rows with < or <=, InnoDB locks the next row even though row based binary logging and read committed is used. Solution: In the handler, when the row is identified to fall outside of the range (as specified in the query predicates), then request the storage engine to unlock the row (if possible). This is done in handler::read_range_first() and handler::read_range_next().
* | merge from 5.1 repo.Andrei Elkin2012-07-103-7/+24
|\ \
| * | BUG#11762670:MY_B_WRITE RETURN VALUE IGNOREDSujatha Sivakumar2012-07-103-7/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Problem: ======= The return value from my_b_write is ignored by: `my_b_write_quoted', `my_b_write_bit',`Query_log_event::print_query_header' Most callers of `my_b_printf' ignore the return value. `log_event.cc' has many calls to it. Analysis: ======== `my_b_write' is used to write data into a file. If the write fails it sets appropriate error number and error message through my_error() function call and sets the IO_CACHE::error == -1. `my_b_printf' function is also used to write data into a file, it internally invokes my_b_write to do the write operation. Upon success it returns number of characters written to file and on error it returns -1 and sets the error through my_error() and also sets IO_CACHE::error == -1. Most of the event specific print functions for example `Create_file_log_event::print', `Execute_load_log_event::print' etc are the ones which make several calls to the above two functions and they do not check for the return value after the 'print' call. All the above mentioned abuse cases deal with the client side. Fix: === As part of bug fix a check for IO_CACHE::error == -1 has been added at a very high level after the call to the 'print' function. There are few more places where the return value of "my_b_write" is ignored those are mentioned below. +++ mysys/mf_iocache2.c 2012-06-04 07:03:15 +0000 @@ -430,7 +430,8 @@ memset(buffz, '0', minimum_width - length2); else memset(buffz, ' ', minimum_width - length2); - my_b_write(info, buffz, minimum_width - length2); +++ sql/log.cc 2012-06-08 09:04:46 +0000 @@ -2388,7 +2388,12 @@ { end= strxmov(buff, "# administrator command: ", NullS); buff_len= (ulong) (end - buff); - my_b_write(&log_file, (uchar*) buff, buff_len); At these places appropriate return value handlers have been added. client/mysqlbinlog.cc: check for IO_CACHE::error == -1 has been added after the call to the event specific print functions mysys/mf_iocache2.c: Added handler to check the written value of `my_b_write' sql/log.cc: Added handler to check the written value of `my_b_write' sql/log_event.cc: Added error simulation statements in `Create_file_log_event::print` and `Execute_load_query_log_event::print' sql/rpl_utility.h: Removed the extra ';'
* | | Bug#14275000Andrei Elkin2012-07-052-5/+22
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes for BUG11761686 left a flaw that managed to slip away from testing. Only effective filtering branch was actually tested with a regression test added to rpl_filter_tables_not_exist. The reason of the failure is destuction of too early mem-root-allocated memory at the end of the deferred User-var's do_apply_event(). Fixed with bypassing free_root() in the deferred execution branch. Deallocation of created in do_apply_event() items is done by the base code through THD::cleanup_after_query() -> free_items() that the parent Query can't miss. sql/log_event.cc: Do not call free_root() in case the deferred User-var event. Necessary methods to the User-var class are added, do_apply_event() refined. sql/log_event.h: Necessary methods to avoid destoying mem-root-based memory at User-var applying are defined.
* | minor update to make MSVS happyGleb Shchepa2012-06-292-2/+2
| |
* | Bug #13708485: malformed resultset packet crashes clientGeorgi Kodinov2012-06-281-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Several fixes : * sql-common/client.c Added a validity check of the fields metadata packet sent by the server. Now libmysql will check if the length of the data sent by the server matches what's expected by the protocol before using the data. * client/mysqltest.cc Fixed the error handling code in mysqltest to avoid sending new commands when the reading the result set failed (and there are unread data in the pipe). * sql_common.h + libmysql/libmysql.c + sql-common/client.c unpack_fields() now generates a proper error when it fails. Added a new argument to this function to support the error generation. * sql/protocol.cc Added a debug trigger to cause the server to send a NULL insted of the packet expected by the client for testing purposes.
* | Bug#14238406 NEW COMPILATION WARNINGS WITH GCC 4.7 (-WERROR=NARROWING)Jon Olav Hauglid2012-06-293-19/+20
| | | | | | | | | | | | This patch fixes various compilation warnings of the type "error: narrowing conversion of 'x' from 'datatype1' to 'datatype2'
* | Backport of the deprecation warning from WL#6219: "Deprecate and remove ↵Gleb Shchepa2012-06-292-1/+28
| | | | | | | | | | | | | | | | | | | | | | | | YEAR(2) type" Print the warning(note): YEAR(x) is deprecated and will be removed in a future release. Please use YEAR(4) instead on "CREATE TABLE ... YEAR(x)" or "ALTER TABLE MODIFY ... YEAR(x)", where x != 4
* | Merge.Norvald H. Ryeng2012-06-282-1/+7
|\ \ | |/ |/|
| * Bug#13003736 CRASH IN ITEM_REF::WALK WITH SUBQUERIESNorvald H. Ryeng2012-06-182-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Problem: Some queries with subqueries and a HAVING clause that consists only of a column not in the select or grouping lists causes the server to crash. During parsing, an Item_ref is constructed for the HAVING column. The name of the column is resolved when JOIN::prepare calls fix_fields() on its having clause. Since the column is not mentioned in the select or grouping lists, a ref pointer is not found and a new Item_field is created instead. The Item_ref is replaced by the Item_field in the tree of HAVING clauses. Since the tree consists only of this item, the pointer that is updated is JOIN::having. However, st_select_lex::having still points to the Item_ref as the root of the tree of HAVING clauses. The bug is triggered when doing filesort for create_sort_index(). When find_all_keys() calls select->cond->walk() it eventually reaches Item_subselect::walk() where it continues to walk the having clauses from lex->having. This means that it finds the Item_ref instead of the new Item_field, and Item_ref::walk() tries to dereference the ref pointer, which is still null. The crash is reproducible only in 5.5, but the problem lies latent in 5.1 and trunk as well. Fix: After calling fix_fields on the having clause in JOIN::prepare(), set select_lex::having to point to the same item as JOIN::having. This patch also fixes a bug in 5.1 and 5.5 that is triggered if the query is executed as a prepared statement. The Item_field is created in the runtime arena when the query is prepared, and the pointer to the item is saved by st_select_lex::fix_prepare_information() and brought back as a dangling pointer when the query is executed, after the runtime arena has been reclaimed. Fix: Backport fix from trunk that switches to the permanent arena before calling Item_ref::fix_fields() in JOIN::prepare(). sql/item.cc: Set context when creating Item_field. sql/sql_select.cc: Switch to permanent arena and update select_lex->having.
* | Bug#11753779: MAX_CONNECT_ERRORS WORKS ONLY WHEN 1STHarin Vadodaria2012-06-192-59/+4
|/ | | | | | INC_HOST_ERRORS() IS CALLED. Description: Reverting patch 3755 for bug#11753779
* Bug#11753779: MAX_CONNECT_ERRORS WORKS ONLY WHEN 1STHarin Vadodaria2012-06-132-4/+59
| | | | | | | | | | | | | INC_HOST_ERRORS() IS CALLED. Issue : Sequence of calling inc_host_errors() and reset_host_errors() required some changes in order to maintain correct connection error count. Solution : Call to reset_host_errors() is shifted to a location after which no calls to inc_host_errors() are made.
* BUG#12400221 - 60926: BINARY LOG EVENTS LARGER THAN MAX_ALLOWED_PACKETManish Kumar2012-06-127-8/+25
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Problem ======== Replication breaks in the cases if the event length exceeds the size of master Dump thread's max_allowed_packet. The reason why this failure is occuring is because the event length is more than the total size of the max_allowed_packet, on addition of the max_event_header length exceeds the max_allowed_packet of the DUMP thread. This causes the Dump thread to break replication and throw an error. That can happen e.g with row-based replication in Update_rows event. Fix ==== The problem is fixed in 2 steps: 1.) The Dump thread limit to read event is increased to the upper limit i.e. Dump thread reads whatever gets logged in the binary log. 2.) On the slave side we increase the the max_allowed_packet for the slave's threads (IO/SQL) by increasing it to 1GB. This is done using the new server option (slave_max_allowed_packet) included, is used to regulate the max_allowed_packet of the slave thread (IO/SQL) by the DBA, and facilitates the sending of large packets from the master to the slave. This causes the large packets to be received by the slave and apply it successfully. sql/log_event.cc: The max_allowed_packet is not evaluated to the new option slave_max_allowed_packet after the fix. sql/log_event.h: Added the new option in the log_event.h file. sql/mysqld.cc: Added a new option to the server. sql/slave.cc: Increasing the session max_allowed_packet to a large value, i.e. not taking global(max_allowed) into consideration, for the slave's threads. sql/sql_repl.cc: The dump thread's max_allowed_packet is set to the upper limit which makes it independent and it now reads whatever gets logged in the binary log.
| * BUG#12400221 - 60926: BINARY LOG EVENTS LARGER THAN MAX_ALLOWED_PACKETManish Kumar2012-05-218-24/+42
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Problem ======== SQL statements close to the size of max_allowed_packet produce binary log events larger than max_allowed_packet. The reason why this failure is occuring is because the event length is more than the total size of the max_allowed_packet + max_event_header length. Now since the event length exceeds this size master Dump thread is unable to send the packet on to the slave. That can happen e.g with row-based replication in Update_rows event. Fix ==== The problem was fixed by increasing the max_allowed_packet for the slave's threads (IO/SQL) by increasing it to 1GB. This is done using the new server option included which is used to regulate the max_allowed_packet of the slave thread (IO/SQL). This causes the large packets to be received by the slave and apply it successfully. sql/log_event.h: Added the new option in the log_event.h file. sql/mysqld.cc: Added a new option to the server. sql/slave.cc: Increasing the session max_allowed_packet to a large value , i.e. not taking global(max_allowed) into consideration, for the slave's threads.
* | Bug#14051002 VALGRIND: CONDITIONAL JUMP OR MOVE IN RR_CMP / MY_QSORTTor Didriksen2012-06-051-1/+1
| | | | | | | | | | Patch for 5.1 and 5.5: fix typo in byte comparison in rr_cmp()