merge 5.3->5.5

12 files changed, 109 insertions, 41 deletions

diff --git a/mysql-test/r/derived.result b/mysql-test/r/derived.result
index 699d3279e3e..3a3b69f1fc7 100644
--- a/mysql-test/r/derived.result
+++ b/mysql-test/r/derived.result
@@ -479,6 +479,28 @@ SELECT * FROM
 WHERE tmp.a;
 a	b
 100	200
+#
+# MDEV-5356: Server crashes in Item_equal::contains on 2nd
+# execution of a PS
+#
+CREATE TABLE t1 (a INT, b INT);
+INSERT INTO t1 VALUES (1,2),(3,4);
+CREATE TABLE t2 (c INT);
+INSERT INTO t2 VALUES (5),(6);
+CREATE TABLE t3 (d INT);
+INSERT INTO t3 VALUES (7),(8);
+CREATE PROCEDURE pr()
+UPDATE t3,
+(SELECT c FROM
+(SELECT 1 FROM t1 WHERE a=72 AND NOT b) sq, 
+t2
+) sq2
+SET d=sq2.c;
+CALL pr();
+CALL pr();
+CALL pr();
+drop procedure pr;
+drop table t1,t2,t3;
 # End of 5.3 tests
 #
 # Bug#58730 Assertion failed: table->key_read == 0 in close_thread_table,
diff --git a/mysql-test/r/repair_symlink-5543.result b/mysql-test/r/repair_symlink-5543.result
new file mode 100644
index 00000000000..051c9ca3472
--- /dev/null
+++ b/mysql-test/r/repair_symlink-5543.result
@@ -0,0 +1,14 @@
+create table t1 (a int) engine=myisam data directory='MYSQL_TMP_DIR';
+insert t1 values (1);
+repair table t1;
+Table	Op	Msg_type	Msg_text
+test.t1	repair	error	Can't create new tempfile: 'MYSQL_TMP_DIR/t1.TMD'
+test.t1	repair	status	Operation failed
+drop table t1;
+create table t2 (a int) engine=aria data directory='MYSQL_TMP_DIR';
+insert t2 values (1);
+repair table t2;
+Table	Op	Msg_type	Msg_text
+test.t2	repair	error	Can't create new tempfile: 'MYSQL_TMP_DIR/t2.TMD'
+test.t2	repair	status	Operation failed
+drop table t2;
diff --git a/mysql-test/t/derived.test b/mysql-test/t/derived.test
index 559a8b76280..4b1d7604b9d 100644
--- a/mysql-test/t/derived.test
+++ b/mysql-test/t/derived.test
@@ -394,6 +394,35 @@ WHERE tmp.b;
 SELECT * FROM 
 ( SELECT 100 a, subsel.b FROM ( SELECT 200 b ) subsel ) tmp
 WHERE tmp.a;
+
+--echo #
+--echo # MDEV-5356: Server crashes in Item_equal::contains on 2nd
+--echo # execution of a PS
+--echo #
+CREATE TABLE t1 (a INT, b INT);
+INSERT INTO t1 VALUES (1,2),(3,4);
+
+CREATE TABLE t2 (c INT);
+INSERT INTO t2 VALUES (5),(6);
+
+CREATE TABLE t3 (d INT);
+INSERT INTO t3 VALUES (7),(8);
+
+CREATE PROCEDURE pr()
+  UPDATE t3,
+    (SELECT c FROM
+      (SELECT 1 FROM t1 WHERE a=72 AND NOT b) sq, 
+      t2
+    ) sq2
+  SET d=sq2.c;
+
+CALL pr();
+CALL pr();
+CALL pr();
+
+drop procedure pr;
+drop table t1,t2,t3;
+
 --echo # End of 5.3 tests
 
 --echo #
diff --git a/mysql-test/t/repair_symlink-5543.test b/mysql-test/t/repair_symlink-5543.test
new file mode 100644
index 00000000000..bad65a4175a
--- /dev/null
+++ b/mysql-test/t/repair_symlink-5543.test
@@ -0,0 +1,26 @@
+#
+# MDEV-5543 MyISAM repair unsafe usage of TMD files 
+#
+--source include/have_symlink.inc
+--source include/not_windows.inc
+--source include/have_maria.inc
+
+--replace_result $MYSQL_TMP_DIR MYSQL_TMP_DIR
+eval create table t1 (a int) engine=myisam data directory='$MYSQL_TMP_DIR';
+insert t1 values (1);
+--system ln -s $MYSQL_TMP_DIR/foobar5543 $MYSQL_TMP_DIR/t1.TMD
+--replace_result $MYSQL_TMP_DIR MYSQL_TMP_DIR
+repair table t1;
+drop table t1;
+
+--replace_result $MYSQL_TMP_DIR MYSQL_TMP_DIR
+eval create table t2 (a int) engine=aria data directory='$MYSQL_TMP_DIR';
+insert t2 values (1);
+--system ln -s $MYSQL_TMP_DIR/foobar5543 $MYSQL_TMP_DIR/t2.TMD
+--replace_result $MYSQL_TMP_DIR MYSQL_TMP_DIR
+repair table t2;
+drop table t2;
+
+--list_files $MYSQL_TMP_DIR foobar5543
+--system rm $MYSQL_TMP_DIR/t1.TMD $MYSQL_TMP_DIR/t2.TMD
+
diff --git a/sql/sql_base.cc b/sql/sql_base.cc
index 84e5ee49fc4..1dbb23226ef 100644
--- a/sql/sql_base.cc
+++ b/sql/sql_base.cc
@@ -8334,12 +8334,9 @@ bool setup_tables(THD *thd, Name_resolution_context *context,
     if (table_list->merge_underlying_list)
     {
       DBUG_ASSERT(table_list->is_merged_derived());
-      Query_arena *arena= thd->stmt_arena, backup;
+      Query_arena *arena, backup;
+      arena= thd->activate_stmt_arena_if_needed(&backup);
       bool res;
-      if (arena->is_conventional())
-        arena= 0;                                   // For easier test
-      else
-        thd->set_n_backup_active_arena(arena, &backup);
       res= table_list->setup_underlying(thd);
       if (arena)
         thd->restore_active_arena(arena, &backup);
@@ -8718,11 +8715,8 @@ void wrap_ident(THD *thd, Item **conds)
 {
   Item_direct_ref_to_ident *wrapper;
   DBUG_ASSERT((*conds)->type() == Item::FIELD_ITEM || (*conds)->type() == Item::REF_ITEM);
-  Query_arena *arena= thd->stmt_arena, backup;
-  if (arena->is_conventional())
-    arena= 0;
-  else
-    thd->set_n_backup_active_arena(arena, &backup);
+  Query_arena *arena, backup;
+  arena= thd->activate_stmt_arena_if_needed(&backup);
   if ((wrapper= new Item_direct_ref_to_ident((Item_ident *)(*conds))))
     (*conds)= (Item*) wrapper;
   if (arena)
diff --git a/sql/sql_derived.cc b/sql/sql_derived.cc
index b7425b188a0..f09c585fa79 100644
--- a/sql/sql_derived.cc
+++ b/sql/sql_derived.cc
@@ -612,11 +612,8 @@ bool mysql_derived_prepare(THD *thd, LEX *lex, TABLE_LIST *derived)
           thd->lex->sql_command == SQLCOM_DELETE_MULTI))))
     DBUG_RETURN(FALSE);
 
-  Query_arena *arena= thd->stmt_arena, backup;
-  if (arena->is_conventional())
-    arena= 0;                                   // For easier test
-  else
-    thd->set_n_backup_active_arena(arena, &backup);
+  Query_arena *arena, backup;
+  arena= thd->activate_stmt_arena_if_needed(&backup);
 
   SELECT_LEX *first_select= unit->first_select();
 
diff --git a/sql/sql_lex.cc b/sql/sql_lex.cc
index fa1bd5a96fa..043841cbb6a 100644
--- a/sql/sql_lex.cc
+++ b/sql/sql_lex.cc
@@ -4075,11 +4075,8 @@ void SELECT_LEX::mark_const_derived(bool empty)
 
 bool st_select_lex::save_leaf_tables(THD *thd)
 {
-  Query_arena *arena= thd->stmt_arena, backup;
-  if (arena->is_conventional())
-    arena= 0;                                  
-  else
-    thd->set_n_backup_active_arena(arena, &backup);
+  Query_arena *arena, backup;
+  arena= thd->activate_stmt_arena_if_needed(&backup);
 
   List_iterator_fast<TABLE_LIST> li(leaf_tables);
   TABLE_LIST *table;
@@ -4107,10 +4104,7 @@ bool st_select_lex::save_prep_leaf_tables(THD *thd)
     return 0;
 
   Query_arena *arena= thd->stmt_arena, backup;
-  if (arena->is_conventional())
-    arena= 0;                                  
-  else
-    thd->set_n_backup_active_arena(arena, &backup);
+  arena= thd->activate_stmt_arena_if_needed(&backup);
 
   List_iterator_fast<TABLE_LIST> li(leaf_tables);
   TABLE_LIST *table;
diff --git a/sql/sql_select.cc b/sql/sql_select.cc
index 5d74e2d7f13..3f515b27278 100644
--- a/sql/sql_select.cc
+++ b/sql/sql_select.cc
@@ -1052,11 +1052,8 @@ JOIN::optimize()
       MEMROOT for prepared statements and stored procedures.
     */
 
-    Query_arena *arena= thd->stmt_arena, backup;
-    if (arena->is_conventional())
-      arena= 0;                                   // For easier test
-    else
-      thd->set_n_backup_active_arena(arena, &backup);
+    Query_arena *arena, backup;
+    arena= thd->activate_stmt_arena_if_needed(&backup);
 
     sel->first_cond_optimization= 0;
 
diff --git a/sql/sql_view.cc b/sql/sql_view.cc
index 52872e8ea5b..74e80cdebfd 100644
--- a/sql/sql_view.cc
+++ b/sql/sql_view.cc
@@ -1138,11 +1138,7 @@ bool mysql_make_view(THD *thd, File_parser *parser, TABLE_LIST *table,
     will be TRUE as far as we make new table cache).
   */
   old_lex= thd->lex;
-  arena= thd->stmt_arena;
-  if (arena->is_conventional())
-    arena= 0;
-  else
-    thd->set_n_backup_active_arena(arena, &backup);
+  arena= thd->activate_stmt_arena_if_needed(&backup);
 
   /* init timestamp */
   if (!table->timestamp.str)
diff --git a/sql/table.cc b/sql/table.cc
index 932ca953c40..bb650130816 100644
--- a/sql/table.cc
+++ b/sql/table.cc
@@ -4087,7 +4087,7 @@ bool TABLE_LIST::create_field_translation(THD *thd)
   SELECT_LEX *select= get_single_select();
   List_iterator_fast<Item> it(select->item_list);
   uint field_count= 0;
-  Query_arena *arena= thd->stmt_arena, backup;
+  Query_arena *arena, backup;
   bool res= FALSE;
   DBUG_ENTER("TABLE_LIST::create_field_translation");
 
@@ -4126,10 +4126,7 @@ bool TABLE_LIST::create_field_translation(THD *thd)
     DBUG_RETURN(FALSE);
   }
 
-  if (arena->is_conventional())
-    arena= 0;                                   // For easier test
-  else
-    thd->set_n_backup_active_arena(arena, &backup);
+  arena= thd->activate_stmt_arena_if_needed(&backup);
 
   /* Create view fields translation table */
 
diff --git a/storage/maria/ha_maria.cc b/storage/maria/ha_maria.cc
index 53076e7be45..94057f57de5 100644
--- a/storage/maria/ha_maria.cc
+++ b/storage/maria/ha_maria.cc
@@ -1,5 +1,6 @@
 /* Copyright (C) 2004-2008 MySQL AB & MySQL Finland AB & TCX DataKonsult AB
    Copyright (C) 2008-2009 Sun Microsystems, Inc.
+   Copyright (c) 2009, 2014, SkySQL Ab.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -1580,7 +1581,7 @@ int ha_maria::repair(THD *thd, HA_CHECK *param, bool do_optimize)
 
   param->db_name= table->s->db.str;
   param->table_name= table->alias.c_ptr();
-  param->tmpfile_createflag= O_RDWR | O_TRUNC;
+  param->tmpfile_createflag= O_RDWR | O_TRUNC | O_EXCL;
   param->using_global_keycache= 1;
   param->thd= thd;
   param->tmpdir= &mysql_tmpdir_list;
diff --git a/storage/myisam/ha_myisam.cc b/storage/myisam/ha_myisam.cc
index cb023c25776..35353dfc9a3 100644
--- a/storage/myisam/ha_myisam.cc
+++ b/storage/myisam/ha_myisam.cc
@@ -1,5 +1,6 @@
 /*
    Copyright (c) 2000, 2012, Oracle and/or its affiliates.
+   Copyright (c) 2009, 2014, SkySQL Ab.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -1071,7 +1072,7 @@ int ha_myisam::repair(THD *thd, HA_CHECK &param, bool do_optimize)
 
   param.db_name=    table->s->db.str;
   param.table_name= table->alias.c_ptr();
-  param.tmpfile_createflag = O_RDWR | O_TRUNC;
+  param.tmpfile_createflag= O_RDWR | O_TRUNC | O_EXCL;
   param.using_global_keycache = 1;
   param.thd= thd;
   param.tmpdir= &mysql_tmpdir_list;