Merge from 5.3

modified:
  mysql-test/r/dyncol.result
  mysql-test/r/type_time.result
  mysql-test/t/dyncol.test
  mysql-test/t/type_time.test
  mysys/ma_dyncol.c
  sql/item.cc
  sql/item_func.cc
pending merges:
  Alexander Barkov 2013-08-12 MDEV-4652 Wrong result for CONCAT(GREATEST(T...
    sanja@montyprogr... 2013-08-01 MDEV-4811 Assertion `offset < 0x1f' f...

7 files changed, 86 insertions, 10 deletions

diff --git a/mysql-test/r/dyncol.result b/mysql-test/r/dyncol.result
index 2411f1070d9..dc2dcf479d7 100644
--- a/mysql-test/r/dyncol.result
+++ b/mysql-test/r/dyncol.result
@@ -1404,5 +1404,26 @@ v1	CREATE ALGORITHM=UNDEFINED DEFINER=`root`@`localhost` SQL SECURITY DEFINER VI
 drop view v1;
 drop table t1;
 #
+# MDEV-4811: Assertion `offset < 0x1f' fails in type_and_offset_store 
+# on COLUMN_ADD
+#
+CREATE TABLE t1 (dyn TINYBLOB) ENGINE=MyISAM;
+INSERT INTO t1 SET dyn = COLUMN_CREATE( 40, REPEAT('a', 233), 4, REPEAT('b', 322) );
+Warnings:
+Warning	1265	Data truncated for column 'dyn' at row 1
+SELECT COLUMN_ADD( dyn, 6, REPEAT('x',80), 4, REPEAT('y',215) AS INTEGER ) FROM t1;
+ERROR HY000: Encountered illegal format of dynamic column string
+DROP table t1;
+#
+# MDEV-4812: Valgrind warnings (Invalid write) in
+# dynamic_column_update_many on COLUMN_ADD
+#
+CREATE TABLE t1 (dyncol TINYBLOB) ENGINE=MyISAM;
+INSERT INTO t1 SET dyncol = COLUMN_CREATE( 7, REPEAT('k',487), 209, REPEAT('x',464) );
+Warnings:
+Warning	1265	Data truncated for column 'dyncol' at row 1
+SELECT COLUMN_ADD( dyncol, 7, '22:22:22', 8, REPEAT('x',270) AS CHAR ) FROM t1;
+DROP table t1;
+#
 # end of 5.3 tests
 #
diff --git a/mysql-test/r/type_time.result b/mysql-test/r/type_time.result
index 4167cbbe252..5a04913553b 100644
--- a/mysql-test/r/type_time.result
+++ b/mysql-test/r/type_time.result
@@ -183,6 +183,15 @@ NULL
 Warnings:
 Warning	1292	Incorrect datetime value: '0000-00-00 00:00:00'
 #
+# MDEV-4652 Wrong result for CONCAT(GREATEST(TIME('00:00:01'),TIME('00:00:00')))
+#
+SELECT CONCAT(GREATEST(TIME('00:00:01'),TIME('00:00:00')));
+CONCAT(GREATEST(TIME('00:00:01'),TIME('00:00:00')))
+00:00:01.000000
+SELECT CONCAT(GREATEST(TIME('32 00:00:01'),TIME('00:00:00')));
+CONCAT(GREATEST(TIME('32 00:00:01'),TIME('00:00:00')))
+768:00:01.000000
+#
 # End of 5.3 tests
 #
 CREATE TABLE t1 (f1 TIME);
diff --git a/mysql-test/t/dyncol.test b/mysql-test/t/dyncol.test
index ca95dea0779..2bf5921c5db 100644
--- a/mysql-test/t/dyncol.test
+++ b/mysql-test/t/dyncol.test
@@ -604,6 +604,29 @@ drop view v1;
 drop table t1;
 
 --echo #
+--echo # MDEV-4811: Assertion `offset < 0x1f' fails in type_and_offset_store 
+--echo # on COLUMN_ADD
+--echo #
+
+CREATE TABLE t1 (dyn TINYBLOB) ENGINE=MyISAM;
+INSERT INTO t1 SET dyn = COLUMN_CREATE( 40, REPEAT('a', 233), 4, REPEAT('b', 322) );
+--error ER_DYN_COL_WRONG_FORMAT
+SELECT COLUMN_ADD( dyn, 6, REPEAT('x',80), 4, REPEAT('y',215) AS INTEGER ) FROM t1;
+
+DROP table t1;
+
+--echo #
+--echo # MDEV-4812: Valgrind warnings (Invalid write) in
+--echo # dynamic_column_update_many on COLUMN_ADD
+--echo #
+CREATE TABLE t1 (dyncol TINYBLOB) ENGINE=MyISAM;
+
+INSERT INTO t1 SET dyncol = COLUMN_CREATE( 7, REPEAT('k',487), 209, REPEAT('x',464) );
+--error 0,ER_DYN_COL_WRONG_FORMAT
+SELECT COLUMN_ADD( dyncol, 7, '22:22:22', 8, REPEAT('x',270) AS CHAR ) FROM t1;
+DROP table t1;
+
+--echo #
 --echo # end of 5.3 tests
 --echo #
 
diff --git a/mysql-test/t/type_time.test b/mysql-test/t/type_time.test
index 19e0c45fbc0..1dd0f4363b9 100644
--- a/mysql-test/t/type_time.test
+++ b/mysql-test/t/type_time.test
@@ -129,6 +129,12 @@ drop table t1;
 SELECT CONVERT_TZ(GREATEST(TIME('00:00:00'),TIME('00:00:00')),'+00:00','+7:5');
 
 --echo #
+--echo # MDEV-4652 Wrong result for CONCAT(GREATEST(TIME('00:00:01'),TIME('00:00:00')))
+--echo #
+SELECT CONCAT(GREATEST(TIME('00:00:01'),TIME('00:00:00')));
+SELECT CONCAT(GREATEST(TIME('32 00:00:01'),TIME('00:00:00')));
+
+--echo #
 --echo # End of 5.3 tests
 --echo #
 
diff --git a/mysys/ma_dyncol.c b/mysys/ma_dyncol.c
index c717f69c3e5..88730f9dc4f 100644
--- a/mysys/ma_dyncol.c
+++ b/mysys/ma_dyncol.c
@@ -1227,13 +1227,14 @@ dynamic_column_create(DYNAMIC_COLUMN *str, uint column_nr,
   @param header_end      Pointer to the header end
   @param offset_size     Size of offset field in bytes
   @param last_offset     Size of the data segment
+  @param error           Set in case of error
 
   @return number of bytes
 */
 
 static size_t get_length_interval(uchar *entry, uchar *entry_next,
                                   uchar *header_end, size_t offset_size,
-                                  size_t last_offset)
+                                  size_t last_offset, my_bool *error)
 {
   size_t offset, offset_next;
   DYNAMIC_COLUMN_TYPE type, type_next;
@@ -1241,8 +1242,12 @@ static size_t get_length_interval(uchar *entry, uchar *entry_next,
 
   type_and_offset_read(&type, &offset, entry, offset_size);
   if (entry_next >= header_end)
+  {
+    *error= 0;
     return (last_offset - offset);
+  }
   type_and_offset_read(&type_next, &offset_next, entry_next, offset_size);
+  *error= (offset_next > last_offset);
   return (offset_next - offset);
 }
 
@@ -1254,17 +1259,18 @@ static size_t get_length_interval(uchar *entry, uchar *entry_next,
   @param header_end      Pointer to the header end
   @param offset_size     Size of offset field in bytes
   @param last_offset     Size of the data segment
+  @param error           Set in case of error
 
   @return number of bytes
 */
 
 static size_t get_length(uchar *entry, uchar *header_end,
                          size_t offset_size,
-                         size_t last_offset)
+                         size_t last_offset, my_bool *error)
 {
   return get_length_interval(entry,
                              entry + offset_size + COLUMN_NUMBER_SIZE,
-                             header_end, offset_size, last_offset);
+                             header_end, offset_size, last_offset, error);
 }
 
 
@@ -1303,6 +1309,7 @@ find_column(DYNAMIC_COLUMN_TYPE *type, uchar **data, size_t *length,
   uchar *entry;
   size_t offset, total_data, header_size, entry_size;
   uchar key[2+4];
+  my_bool error;
 
   if (!entry_pos)
     entry_pos= &entry;
@@ -1328,12 +1335,12 @@ find_column(DYNAMIC_COLUMN_TYPE *type, uchar **data, size_t *length,
     return 1;
   *data= header + header_size + offset;
   *length= get_length(entry, header + header_size, offset_size,
-                      total_data);
+                      total_data, &error);
   /*
     Check that the found data is withing the ranges. This can happen if
     we get data with wrong offsets.
   */
-  if ((long) *length < 0 || offset + *length > total_data)
+  if (error || (long) *length < 0 || offset + *length > total_data)
     return 1;
 
   *entry_pos= entry;
@@ -1835,12 +1842,13 @@ dynamic_column_update_many(DYNAMIC_COLUMN *str,
                    entry_size, column_count, &entry))
     {
       size_t entry_data_size;
+      my_bool error;
 
       /* Data existed; We have to replace or delete it */
 
       entry_data_size= get_length(entry, header_end,
-                                  offset_size, max_offset);
-      if ((long) entry_data_size < 0)
+                                  offset_size, max_offset, &error);
+      if (error || (long) entry_data_size < 0)
       {
         rc= ER_DYNCOL_FORMAT;
         goto end;
@@ -2036,12 +2044,13 @@ dynamic_column_update_many(DYNAMIC_COLUMN *str,
       /* copy first the data that was not replaced in original packed data */
       if (start < end)
       {
+        my_bool error;
         /* Add old data last in 'tmp' */
         size_t data_size=
           get_length_interval(header_base + start * entry_size,
                               header_base + end * entry_size,
-                              header_end, offset_size, max_offset);
-        if ((long) data_size < 0 ||
+                              header_end, offset_size, max_offset, &error);
+        if (error || (long) data_size < 0 ||
             data_size > max_offset - first_offset)
         {
           dynamic_column_column_free(&tmp);
diff --git a/sql/item.cc b/sql/item.cc
index 9862db4e597..bfc128a16ac 100644
--- a/sql/item.cc
+++ b/sql/item.cc
@@ -297,7 +297,8 @@ String *Item::val_string_from_decimal(String *str)
 String *Item::val_string_from_date(String *str)
 {
   MYSQL_TIME ltime;
-  if (get_date(&ltime, 0) ||
+  if (get_date(&ltime,
+               field_type() == MYSQL_TYPE_TIME ? TIME_TIME_ONLY : 0) ||
       str->alloc(MAX_DATE_STRING_REP_LENGTH))
   {
     null_value= 1;
diff --git a/sql/item_func.cc b/sql/item_func.cc
index 2fa9b35db9e..2b94333272b 100644
--- a/sql/item_func.cc
+++ b/sql/item_func.cc
@@ -2791,6 +2791,13 @@ bool Item_func_min_max::get_date(MYSQL_TIME *ltime, ulonglong fuzzy_date)
     ltime->time_type= MYSQL_TIMESTAMP_DATE;
     ltime->hour= ltime->minute= ltime->second= ltime->second_part= 0;
   }
+  else if (compare_as_dates->field_type() == MYSQL_TYPE_TIME)
+  {
+    ltime->time_type= MYSQL_TIMESTAMP_TIME;
+    ltime->hour+= (ltime->month * 32 + ltime->day) * 24;
+    ltime->month= ltime->day= 0;
+  }
+
 
   return (null_value= 0);
 }