diff options
author | Marko Mäkelä <marko.makela@mariadb.com> | 2020-11-11 18:31:42 +0200 |
---|---|---|
committer | Marko Mäkelä <marko.makela@mariadb.com> | 2020-11-11 18:31:42 +0200 |
commit | dd33a70dad2b32aa6fcdbd1f8161d5351f6dbebd (patch) | |
tree | 2a21689ccb10ab625a47f86bca935e73f5ab5343 | |
parent | 15550ed3a4d81423210a1729f72852d115da8190 (diff) | |
parent | bea84aefb0563a10a310ea81d46c372919345c10 (diff) | |
download | mariadb-git-dd33a70dad2b32aa6fcdbd1f8161d5351f6dbebd.tar.gz |
Merge mariadb-10.2.36 into 10.2
-rw-r--r-- | mysql-test/r/range.result | 35 | ||||
-rw-r--r-- | mysql-test/r/range_mrr_icp.result | 35 | ||||
-rw-r--r-- | mysql-test/t/range.test | 46 | ||||
-rw-r--r-- | sql/opt_range.cc | 14 | ||||
-rw-r--r-- | sql/sql_prepare.cc | 21 | ||||
-rw-r--r-- | tests/mysql_client_test.c | 7 |
6 files changed, 143 insertions, 15 deletions
diff --git a/mysql-test/r/range.result b/mysql-test/r/range.result index 7299982e72d..9ea0dc12a0b 100644 --- a/mysql-test/r/range.result +++ b/mysql-test/r/range.result @@ -1274,7 +1274,7 @@ SELECT * FROM t1 WHERE 5 <= a AND b = 3 OR 3 <= a; id select_type table type possible_keys key key_len ref rows Extra -1 SIMPLE t1 range a a 5 NULL 3 Using where; Using index +1 SIMPLE t1 range a a 5 NULL 4 Using where; Using index SELECT * FROM t1 WHERE 3 <= a AND a <= 5 OR 5 <= a AND b = 3 OR @@ -3054,6 +3054,39 @@ a b set eq_range_index_dive_limit=default; drop table t1; # +# MDEV-24117: Memory management problem in statistics state... +# (just the testcase) +# +create table t0(a int); +insert into t0 values (0),(1),(2),(3),(4),(5),(6),(7),(8),(9); +create table t1(a int); +insert into t1 +select A.a + B.a* 10 + C.a * 100 + D.a * 1000 +from t0 A, t0 B, t0 C, t0 D +where D.a<4; +create table t2 ( +a int, +b int, +key(a) +); +insert into t2 values (1,1),(2,2),(3,3); +set @query=(select group_concat(a) from t1); +set @tmp_24117= @@max_session_mem_used; +# +# On debug build, the usage was +# - 2.8M without the bug +# - 1G with the bug. +set max_session_mem_used=64*1024*1024; +set @query=concat('explain select * from t2 where a in (', @query, ')'); +prepare s from @query; +# This should not fail with an error: +execute s; +id select_type table type possible_keys key key_len ref rows Extra +1 SIMPLE t2 ALL a NULL NULL NULL 3 Using where +set max_session_mem_used=@tmp_24117; +deallocate prepare s; +drop table t0,t1,t2; +# # MDEV-23811: Both disjunct of WHERE condition contain range conditions # for the same index such that the second range condition # fully covers the first one. Additionally one of the disjuncts diff --git a/mysql-test/r/range_mrr_icp.result b/mysql-test/r/range_mrr_icp.result index cdaaa5e8ab7..55613261ce9 100644 --- a/mysql-test/r/range_mrr_icp.result +++ b/mysql-test/r/range_mrr_icp.result @@ -1276,7 +1276,7 @@ SELECT * FROM t1 WHERE 5 <= a AND b = 3 OR 3 <= a; id select_type table type possible_keys key key_len ref rows Extra -1 SIMPLE t1 range a a 5 NULL 3 Using where; Using index +1 SIMPLE t1 range a a 5 NULL 4 Using where; Using index SELECT * FROM t1 WHERE 3 <= a AND a <= 5 OR 5 <= a AND b = 3 OR @@ -3066,6 +3066,39 @@ a b set eq_range_index_dive_limit=default; drop table t1; # +# MDEV-24117: Memory management problem in statistics state... +# (just the testcase) +# +create table t0(a int); +insert into t0 values (0),(1),(2),(3),(4),(5),(6),(7),(8),(9); +create table t1(a int); +insert into t1 +select A.a + B.a* 10 + C.a * 100 + D.a * 1000 +from t0 A, t0 B, t0 C, t0 D +where D.a<4; +create table t2 ( +a int, +b int, +key(a) +); +insert into t2 values (1,1),(2,2),(3,3); +set @query=(select group_concat(a) from t1); +set @tmp_24117= @@max_session_mem_used; +# +# On debug build, the usage was +# - 2.8M without the bug +# - 1G with the bug. +set max_session_mem_used=64*1024*1024; +set @query=concat('explain select * from t2 where a in (', @query, ')'); +prepare s from @query; +# This should not fail with an error: +execute s; +id select_type table type possible_keys key key_len ref rows Extra +1 SIMPLE t2 ALL a NULL NULL NULL 3 Using where +set max_session_mem_used=@tmp_24117; +deallocate prepare s; +drop table t0,t1,t2; +# # MDEV-23811: Both disjunct of WHERE condition contain range conditions # for the same index such that the second range condition # fully covers the first one. Additionally one of the disjuncts diff --git a/mysql-test/t/range.test b/mysql-test/t/range.test index 0d2fbe24835..264f7c784ce 100644 --- a/mysql-test/t/range.test +++ b/mysql-test/t/range.test @@ -2096,6 +2096,52 @@ set eq_range_index_dive_limit=default; drop table t1; --echo # +--echo # MDEV-24117: Memory management problem in statistics state... +--echo # (just the testcase) +--echo # + +create table t0(a int); +insert into t0 values (0),(1),(2),(3),(4),(5),(6),(7),(8),(9); + +create table t1(a int); + +# 4K rows +insert into t1 +select A.a + B.a* 10 + C.a * 100 + D.a * 1000 +from t0 A, t0 B, t0 C, t0 D +where D.a<4; + +create table t2 ( + a int, + b int, + key(a) +); + +insert into t2 values (1,1),(2,2),(3,3); + +set @query=(select group_concat(a) from t1); + +set @tmp_24117= @@max_session_mem_used; + +--echo # +--echo # On debug build, the usage was +--echo # - 2.8M without the bug +--echo # - 1G with the bug. + +set max_session_mem_used=64*1024*1024; + +set @query=concat('explain select * from t2 where a in (', @query, ')'); + +prepare s from @query; + +--echo # This should not fail with an error: +execute s; +set max_session_mem_used=@tmp_24117; + +deallocate prepare s; + +drop table t0,t1,t2; +--echo # --echo # MDEV-23811: Both disjunct of WHERE condition contain range conditions --echo # for the same index such that the second range condition --echo # fully covers the first one. Additionally one of the disjuncts diff --git a/sql/opt_range.cc b/sql/opt_range.cc index 94c39a15936..cbf82a20f4a 100644 --- a/sql/opt_range.cc +++ b/sql/opt_range.cc @@ -8872,15 +8872,9 @@ tree_or(RANGE_OPT_PARAM *param,SEL_TREE *tree1,SEL_TREE *tree2) } bool no_imerge_from_ranges= FALSE; - SEL_TREE *rt1= tree1; - SEL_TREE *rt2= tree2; /* Build the range part of the tree for the formula (1) */ if (sel_trees_can_be_ored(param, tree1, tree2, &ored_keys)) { - if (no_merges1) - rt1= new SEL_TREE(tree1, TRUE, param); - if (no_merges2) - rt2= new SEL_TREE(tree2, TRUE, param); bool must_be_ored= sel_trees_must_be_ored(param, tree1, tree2, ored_keys); no_imerge_from_ranges= must_be_ored; @@ -8938,6 +8932,12 @@ tree_or(RANGE_OPT_PARAM *param,SEL_TREE *tree1,SEL_TREE *tree2) else if (!no_ranges1 && !no_ranges2 && !no_imerge_from_ranges) { /* Build the imerge part of the tree for the formula (1) */ + SEL_TREE *rt1= tree1; + SEL_TREE *rt2= tree2; + if (no_merges1) + rt1= new SEL_TREE(tree1, TRUE, param); + if (no_merges2) + rt2= new SEL_TREE(tree2, TRUE, param); if (!rt1 || !rt2 || result->merges.push_back(imerge_from_ranges) || imerge_from_ranges->or_sel_tree(param, rt1) || @@ -9601,7 +9601,7 @@ key_or(RANGE_OPT_PARAM *param, SEL_ARG *key1,SEL_ARG *key2) if (!tmp->next_key_part) { SEL_ARG *key2_next= key2->next; - if (key2->use_count) + if (key2_shared) { SEL_ARG *key2_cpy= new SEL_ARG(*key2); if (!key2_cpy) diff --git a/sql/sql_prepare.cc b/sql/sql_prepare.cc index 11edd577309..4bf8142959d 100644 --- a/sql/sql_prepare.cc +++ b/sql/sql_prepare.cc @@ -3271,10 +3271,19 @@ void mysqld_stmt_execute(THD *thd, char *packet_arg, uint packet_length) void mysqld_stmt_bulk_execute(THD *thd, char *packet_arg, uint packet_length) { uchar *packet= (uchar*)packet_arg; // GCC 4.0.1 workaround + DBUG_ENTER("mysqld_stmt_execute_bulk"); + + const uint packet_header_lenght= 4 + 2; //ID & 2 bytes of flags + + if (packet_length < packet_header_lenght) + { + my_error(ER_MALFORMED_PACKET, MYF(0)); + DBUG_VOID_RETURN; + } + ulong stmt_id= uint4korr(packet); uint flags= (uint) uint2korr(packet + 4); uchar *packet_end= packet + packet_length; - DBUG_ENTER("mysqld_stmt_execute_bulk"); if (!(thd->client_capabilities & MARIADB_CLIENT_STMT_BULK_OPERATIONS)) @@ -3282,16 +3291,18 @@ void mysqld_stmt_bulk_execute(THD *thd, char *packet_arg, uint packet_length) DBUG_PRINT("error", ("An attempt to execute bulk operation without support")); my_error(ER_UNSUPPORTED_PS, MYF(0)); + DBUG_VOID_RETURN; } /* Check for implemented parameters */ if (flags & (~STMT_BULK_FLAG_CLIENT_SEND_TYPES)) { DBUG_PRINT("error", ("unsupported bulk execute flags %x", flags)); my_error(ER_UNSUPPORTED_PS, MYF(0)); + DBUG_VOID_RETURN; } /* stmt id and two bytes of flags */ - packet+= 4 + 2; + packet+= packet_header_lenght; mysql_stmt_execute_common(thd, stmt_id, packet, packet_end, 0, TRUE, (flags & STMT_BULK_FLAG_CLIENT_SEND_TYPES)); DBUG_VOID_RETURN; @@ -3368,9 +3379,11 @@ stmt_execute_packet_sanity_check(Prepared_statement *stmt, { /* If there is no parameters, this should be normally already end - of the packet. If it's not - then error + of the packet, but it is not a problem if something left (popular + mistake in protocol implementation) because we will not read anymore + from the buffer. */ - return (packet_end > packet); + return false; } return false; } diff --git a/tests/mysql_client_test.c b/tests/mysql_client_test.c index 058168eedd5..93f23236dbc 100644 --- a/tests/mysql_client_test.c +++ b/tests/mysql_client_test.c @@ -20032,8 +20032,11 @@ static void test_mdev19838() " VALUES " "(0x1111111111111111)", -1); - /* Expecting an error if parameters are sent */ - DIE_UNLESS(rc != 0 || paramCount == 0); + /* + We allow junk at the end of the packet in case of + no parameters. So it will succeed. + */ + DIE_UNLESS(rc == 0); } mysql_stmt_close(stmt); |