Bug #56753 mtr silently ignores junk after backticks

When stepping backward to end of `` expression, check for illegal chars

5 files changed, 29 insertions, 3 deletions

diff --git a/client/mysqltest.cc b/client/mysqltest.cc
index 31854737cbc..a84ad2ad9e8 100644
--- a/client/mysqltest.cc
+++ b/client/mysqltest.cc
@@ -2181,8 +2181,14 @@ void var_query_set(VAR *var, const char *query, const char** query_end)
   DBUG_ENTER("var_query_set");
   LINT_INIT(res);
 
+  /* Only white space or ) allowed past ending ` */
   while (end > query && *end != '`')
+  {
+    if (*end && (*end != ' ' && *end != '\t' && *end != '\n' && *end != ')'))
+      die("Spurious text after `query` expression");
     --end;
+  }
+
   if (query == end)
     die("Syntax error in query, missing '`'");
   ++query;
diff --git a/mysql-test/include/setup_fake_relay_log.inc b/mysql-test/include/setup_fake_relay_log.inc
index 5b9e7f72fdd..fb035941a29 100644
--- a/mysql-test/include/setup_fake_relay_log.inc
+++ b/mysql-test/include/setup_fake_relay_log.inc
@@ -72,7 +72,7 @@ copy_file $fake_relay_log $_fake_relay_log;
 
 if (`SELECT LENGTH(@@secure_file_priv) > 0`)
 {
-  -- let $_file_priv_dir= `SELECT @@secure_file_priv`;
+  -- let $_file_priv_dir= `SELECT @@secure_file_priv`
   -- let $_suffix= `SELECT UUID()`
   -- let $_tmp_file= $_file_priv_dir/fake-index.$_suffix
 
diff --git a/mysql-test/r/mysqltest.result b/mysql-test/r/mysqltest.result
index 1044127b06e..650cc069b7f 100644
--- a/mysql-test/r/mysqltest.result
+++ b/mysql-test/r/mysqltest.result
@@ -177,6 +177,9 @@ mysqltest: At line 1: End of line junk detected: "disconnect default # comment
 "
 mysqltest: At line 1: Extra delimiter ";" found
 mysqltest: At line 1: Extra delimiter ";" found
+mysqltest: At line 1: Spurious text after `query` expression
+mysqltest: At line 1: Spurious text after `query` expression
+mysqltest: At line 2: Spurious text after `query` expression
 mysqltest: At line 1: Missing argument(s) to 'error'
 mysqltest: At line 1: Missing argument(s) to 'error'
 mysqltest: At line 1: The sqlstate definition must start with an uppercase S
diff --git a/mysql-test/suite/rpl/t/rpl_row_tbl_metadata.test b/mysql-test/suite/rpl/t/rpl_row_tbl_metadata.test
index be5ebb661ca..d854aa64dc5 100644
--- a/mysql-test/suite/rpl/t/rpl_row_tbl_metadata.test
+++ b/mysql-test/suite/rpl/t/rpl_row_tbl_metadata.test
@@ -205,7 +205,7 @@ DROP TABLE `t1`;
 
 -- echo === Using mysqlbinlog to detect failure. Before the patch mysqlbinlog would find a corrupted event, thence would fail.
 
--- let $MYSQLD_DATADIR= `SELECT @@datadir`;
+-- let $MYSQLD_DATADIR= `SELECT @@datadir`
 -- exec $MYSQL_BINLOG $MYSQLD_DATADIR/master-bin.000001 > $MYSQLTEST_VARDIR/tmp/mysqlbinlog_bug42749.binlog
 -- remove_file $MYSQLTEST_VARDIR/tmp/mysqlbinlog_bug42749.binlog
 
@@ -330,7 +330,7 @@ while($ntables)
 -- echo ### assertion: check that binlog is not corrupt. Using mysqlbinlog to 
 -- echo ###            detect failure. Before the patch mysqlbinlog would find 
 -- echo ###            a corrupted event, thence would fail.
--- let $MYSQLD_DATADIR= `SELECT @@datadir`;
+-- let $MYSQLD_DATADIR= `SELECT @@datadir`
 -- exec $MYSQL_BINLOG -v --hex $MYSQLD_DATADIR/master-bin.000001 > $MYSQLTEST_VARDIR/tmp/mysqlbinlog_bug50018.binlog
 
 ## clean up
diff --git a/mysql-test/t/mysqltest.test b/mysql-test/t/mysqltest.test
index 9da19ec00e0..597adffd035 100644
--- a/mysql-test/t/mysqltest.test
+++ b/mysql-test/t/mysqltest.test
@@ -494,6 +494,23 @@ remove_file $MYSQLTEST_VARDIR/tmp/mysqltest.sql;
 --error 1
 --exec echo "--disable_query_log;" | $MYSQL_TEST 2>&1
 
+#
+# Extra text after ``
+#
+--error 1
+-- exec echo "let \$x= \`select 1\` BOO ;" | $MYSQL_TEST 2>&1
+--error 1
+-- exec echo "--let \$x= \`select 1\`;" | $MYSQL_TEST 2>&1
+--write_file $MYSQLTEST_VARDIR/tmp/mysqltest.sql
+# Missing ; in next line should be detected and cause failure
+let $x= `select 1`
+let $x= 2;
+echo $x;
+EOF
+--error 1
+--exec $MYSQL_TEST < $MYSQLTEST_VARDIR/tmp/mysqltest.sql 2>&1
+remove_file $MYSQLTEST_VARDIR/tmp/mysqltest.sql;
+
 
 # Allow trailing # comment
 --sleep 1 # Wait for insert delayed to be executed.