Bug #30695: An apostrophe ' in the comment of the ADD PARTITION

  causes the Server to crash.

Accessing partitioned table with an apostrophe in partition options
like DATA DIRECTORY, INDEX DIRECTORY or COMMENT causes server crash.

Partition options were saved in .frm file without escaping.
When accessing such table it is not possible to properly restore
partition information.
Crashed because there was no check for partition info parser failure.

Fixed by escaping quoted text in the partition info when writing it to
the frm-file and added a check that it was able to parse the partition
info before using it 

NOTE: If the comment is written by an earlier version of the server,
the corrupted frm-file is not fixed, but left corrupted, you have to
manually drop the table and recreate it.


mysql-test/r/partition.result:
  bug #30695: An apostrophe ' in the comment of the ADD PARTITION causes
  the Server to crash.
   testresult
mysql-test/t/partition.test:
  bug #30695: An apostrophe ' in the comment of the ADD PARTITION causes
  the Server to crash.
    testcase
sql/sql_partition.cc:
  Bug #30695: An apostrophe ' in the comment of the ADD PARTITION causes
    the Server to crash.
  
    Crashes when there is an non escaped apostrophe in the partition options
  
    fixed by escaping quoted text before writing to the frm-file
sql/table.cc:
  Bug #30695 An apostrophe ' in the comment of the ADD PARTITION
    causes the Server to crash
  
  problem was using a null poiter without check -> crash.
  
  added a check that the previus call succeded

4 files changed, 61 insertions, 5 deletions

diff --git a/mysql-test/r/partition.result b/mysql-test/r/partition.result
index 5d985d053fc..2057b18de3d 100644
--- a/mysql-test/r/partition.result
+++ b/mysql-test/r/partition.result
@@ -1,4 +1,20 @@
 drop table if exists t1;
+CREATE TABLE t1 (
+d DATE NOT NULL
+)
+PARTITION BY RANGE( YEAR(d) ) (
+PARTITION p0 VALUES LESS THAN (1960),
+PARTITION p1 VALUES LESS THAN (1970),
+PARTITION p2 VALUES LESS THAN (1980),
+PARTITION p3 VALUES LESS THAN (1990)
+);
+ALTER TABLE t1 ADD PARTITION (
+PARTITION `p5` VALUES LESS THAN (2010)
+COMMENT 'APSTART \' APEND'
+);
+SELECT * FROM t1 LIMIT 1;
+d
+DROP TABLE t1;
 create table t1 (a int)
 partition by key(a)
 partitions 0.2+e1;
diff --git a/mysql-test/t/partition.test b/mysql-test/t/partition.test
index 42db23dadef..53454b132e9 100644
--- a/mysql-test/t/partition.test
+++ b/mysql-test/t/partition.test
@@ -10,6 +10,32 @@ drop table if exists t1;
 --enable_warnings
 
 #
+# Bug #30695: An apostrophe ' in the comment of the ADD PARTITION causes the Server to crash.
+#
+# To verify the fix for crashing (on unix-type OS)
+# uncomment the exec and error rows!
+
+CREATE TABLE t1 (
+    d DATE NOT NULL
+)
+PARTITION BY RANGE( YEAR(d) ) (
+    PARTITION p0 VALUES LESS THAN (1960),
+    PARTITION p1 VALUES LESS THAN (1970),
+    PARTITION p2 VALUES LESS THAN (1980),
+    PARTITION p3 VALUES LESS THAN (1990)
+);
+
+ALTER TABLE t1 ADD PARTITION (
+PARTITION `p5` VALUES LESS THAN (2010)
+COMMENT 'APSTART \' APEND'
+);
+#--exec sed 's/APSTART \\/APSTART  /' var/master-data/test/t1.frm > tmpt1.frm && mv tmpt1.frm var/master-data/test/t1.frm
+#--error 1064
+SELECT * FROM t1 LIMIT 1;
+
+DROP TABLE t1;
+
+#
 # Bug 15890: Strange number of partitions accepted
 #
 -- error 1064
diff --git a/sql/sql_partition.cc b/sql/sql_partition.cc
index 8a8a03cb4e4..3ad2cbfb284 100644
--- a/sql/sql_partition.cc
+++ b/sql/sql_partition.cc
@@ -1849,6 +1849,20 @@ static int add_uint(File fptr, ulonglong number)
   return add_string(fptr, buff);
 }
 
+/*
+   Must escape strings in partitioned tables frm-files,
+   parsing it later with mysql_unpack_partition will fail otherwise.
+*/
+static int add_quoted_string(File fptr, const char *quotestr)
+{
+  String orgstr(quotestr, system_charset_info);
+  String escapedstr;
+  int err= add_string(fptr, "'");
+  err+= append_escaped(&escapedstr, &orgstr);
+  err+= add_string(fptr, escapedstr.c_ptr());
+  return err + add_string(fptr, "'");
+}
+
 static int add_keyword_string(File fptr, const char *keyword,
                               bool should_use_quotes, 
                               const char *keystr)
@@ -1859,10 +1873,9 @@ static int add_keyword_string(File fptr, const char *keyword,
   err+= add_equal(fptr);
   err+= add_space(fptr);
   if (should_use_quotes)
-    err+= add_string(fptr, "'");
-  err+= add_string(fptr, keystr);
-  if (should_use_quotes)
-    err+= add_string(fptr, "'");
+    err+= add_quoted_string(fptr, keystr);
+  else
+    err+= add_string(fptr, keystr);
   return err + add_space(fptr);
 }
 
diff --git a/sql/table.cc b/sql/table.cc
index ccddbf8134b..7cf5eeaaad6 100644
--- a/sql/table.cc
+++ b/sql/table.cc
@@ -1782,7 +1782,8 @@ int open_table_from_share(THD *thd, TABLE_SHARE *share, const char *alias,
                                 outparam, is_create_table,
                                 share->default_part_db_type,
                                 &work_part_info_used);
-    outparam->part_info->is_auto_partitioned= share->auto_partitioned;
+    if (!tmp)
+      outparam->part_info->is_auto_partitioned= share->auto_partitioned;
     DBUG_PRINT("info", ("autopartitioned: %u", share->auto_partitioned));
     /* we should perform the fix_partition_func in either local or
        caller's arena depending on work_part_info_used value