Fix reference to not initialized memory

Changed handing of priv_host to fix bug in FLUSH PRIVILEGES


libmysqld/lib_sql.cc:
  Changed handing of priv_host to fix bug in FLUSH PRIVILEGES
myisam/mi_rkey.c:
  Fix reference to not initialized memory
sql/sql_acl.cc:
  Changed handing of priv_host to fix bug in FLUSH PRIVILEGES
sql/sql_acl.h:
  Changed handing of priv_host to fix bug in FLUSH PRIVILEGES
sql/sql_class.h:
  Changed handing of priv_host to fix bug in FLUSH PRIVILEGES
sql/sql_parse.cc:
  Changed handing of priv_host to fix bug in FLUSH PRIVILEGES
sql/unireg.h:
  Changed handing of priv_host to fix bug in FLUSH PRIVILEGES

7 files changed, 17 insertions, 9 deletions

diff --git a/libmysqld/lib_sql.cc b/libmysqld/lib_sql.cc
index 4e85c29c2f2..83f398ca50b 100644
--- a/libmysqld/lib_sql.cc
+++ b/libmysqld/lib_sql.cc
@@ -226,7 +226,7 @@ static bool check_user(THD *thd,enum_server_command command, const char *user,
   }
   thd->master_access=acl_getroot(thd, thd->host, thd->ip, thd->user,
 				 passwd, thd->scramble,
-                                 &thd->priv_user, &thd->priv_host,
+                                 &thd->priv_user, thd->priv_host,
 				 protocol_version == 9 ||
 				 !(thd->client_capabilities &
 				   CLIENT_LONG_PASSWORD),&ur);
diff --git a/myisam/mi_rkey.c b/myisam/mi_rkey.c
index 60dec0449a0..1bb478efd3d 100644
--- a/myisam/mi_rkey.c
+++ b/myisam/mi_rkey.c
@@ -93,13 +93,16 @@ int mi_rkey(MI_INFO *info, byte *buf, int inx, const byte *key, uint key_len,
     rw_unlock(&share->key_root_lock[inx]);
 
   /* Calculate length of the found key;  Used by mi_rnext_same */
-  if ((keyinfo->flag & HA_VAR_LENGTH_KEY) && last_used_keyseg)
+  if ((keyinfo->flag & HA_VAR_LENGTH_KEY) && last_used_keyseg &&
+      info->lastpos != HA_OFFSET_ERROR)
     info->last_rkey_length= _mi_keylength_part(keyinfo, info->lastkey,
 					       last_used_keyseg);
   else
     info->last_rkey_length= pack_key_length;
+
+  /* Check if we don't want to have record back, only error message */
   if (!buf)
-    DBUG_RETURN(info->lastpos==HA_OFFSET_ERROR ? my_errno : 0);
+    DBUG_RETURN(info->lastpos == HA_OFFSET_ERROR ? my_errno : 0);
 
   if (!(*info->read_record)(info,info->lastpos,buf))
   {
@@ -109,7 +112,7 @@ int mi_rkey(MI_INFO *info, byte *buf, int inx, const byte *key, uint key_len,
 
   info->lastpos = HA_OFFSET_ERROR;		/* Didn't find key */
 
-  /* Store key for read next */
+  /* Store last used key as a base for read next */
   memcpy(info->lastkey,key_buff,pack_key_length);
   info->last_rkey_length= pack_key_length;
   bzero((char*) info->lastkey+pack_key_length,info->s->base.rec_reflength);
diff --git a/sql/sql_acl.cc b/sql/sql_acl.cc
index e14fa891977..bdf1a2ac716 100644
--- a/sql/sql_acl.cc
+++ b/sql/sql_acl.cc
@@ -493,7 +493,7 @@ static int acl_compare(ACL_ACCESS *a,ACL_ACCESS *b)
 
 ulong acl_getroot(THD *thd, const char *host, const char *ip, const char *user,
 		  const char *password,const char *message,
-                  char **priv_user, char **priv_host,
+                  char **priv_user, char *priv_host,
 		  bool old_ver, USER_RESOURCES  *mqh)
 {
   ulong user_access=NO_ACCESS;
@@ -623,7 +623,10 @@ ulong acl_getroot(THD *thd, const char *host, const char *ip, const char *user,
 	  *mqh=acl_user->user_resource;
 	  if (!acl_user->user)
 	    *priv_user=(char*) "";	// Change to anonymous user /* purecov: inspected */
-          *priv_host=acl_user->host.hostname;
+	  if (acl_user->host.hostname)
+	    strmake(priv_host, acl_user->host.hostname, MAX_HOSTNAME);
+	  else
+	    *priv_host= 0;
 	  break;
 	}
 #ifndef ALLOW_DOWNGRADE_OF_USERS
diff --git a/sql/sql_acl.h b/sql/sql_acl.h
index 26e445fb7ea..1d074fe6001 100644
--- a/sql/sql_acl.h
+++ b/sql/sql_acl.h
@@ -88,7 +88,7 @@ ulong acl_get(const char *host, const char *ip, const char *bin_ip,
 	      const char *user, const char *db);
 ulong acl_getroot(THD *thd, const char *host, const char *ip, const char *user,
 		  const char *password,const char *scramble,
-                  char **priv_user, char **priv_host,
+                  char **priv_user, char *priv_host,
 		  bool old_ver, USER_RESOURCES *max);
 bool acl_check_host(const char *host, const char *ip);
 bool check_change_password(THD *thd, const char *host, const char *user);
diff --git a/sql/sql_class.h b/sql/sql_class.h
index 26551b01da1..160c06ca3c6 100644
--- a/sql/sql_class.h
+++ b/sql/sql_class.h
@@ -351,7 +351,8 @@ public:
     db - currently selected database
     ip - client IP
    */
-  char	  *host,*user,*priv_user,*priv_host,*db,*ip;
+  char	  *host,*user,*priv_user,*db,*ip;
+  char	  priv_host[MAX_HOSTNAME];
   /* remote (peer) port */
   uint16 peer_port;
   /* Points to info-string that will show in SHOW PROCESSLIST */
diff --git a/sql/sql_parse.cc b/sql/sql_parse.cc
index 33b6c3f45c0..8d4ae065aa6 100644
--- a/sql/sql_parse.cc
+++ b/sql/sql_parse.cc
@@ -206,7 +206,7 @@ static bool check_user(THD *thd,enum_server_command command, const char *user,
   }
   thd->master_access=acl_getroot(thd, thd->host, thd->ip, thd->user,
 				 passwd, thd->scramble,
-                                 &thd->priv_user, &thd->priv_host,
+                                 &thd->priv_user, thd->priv_host,
 				 protocol_version == 9 ||
 				 !(thd->client_capabilities &
 				   CLIENT_LONG_PASSWORD),&ur);
diff --git a/sql/unireg.h b/sql/unireg.h
index 7e98d0d3cbe..f69d67455dd 100644
--- a/sql/unireg.h
+++ b/sql/unireg.h
@@ -55,6 +55,7 @@
 #else
 #define MAX_REFLENGTH 4				/* Max length for record ref */
 #endif
+#define MAX_HOSTNAME  61			/* len+1 in mysql.user */
 
 #define MAX_FIELD_WIDTH 256			/* Max column width +1 */
 #define MAX_TABLES	(sizeof(table_map)*8-1)	/* Max tables in join */