Fix for BUG#8351 (5.0) - Double quote in Boolean Fulltext query causes crash

myisam/ft_boolean_search.c:
  Put phrase words, including stopwords into list `phrase'.
  Use `phrase' instead of `qout', `qend' in _ftb_strstr.
myisam/ft_parser.c:
  ft_get_word extended, so it can return short words and stopwords. (return value 4)
  ft_simple_get_word extended, so it can return short words and stopwords
  when skip_stopwords is false.
myisam/ft_stopwords.c:
  One more argument for ft_simple_get_word.
myisam/ftdefs.h:
  One more argument for ft_simple_get_word added.
  Third argument of ft_simple_get_word changet to const.

1 files changed, 41 insertions, 21 deletions

diff --git a/myisam/ft_boolean_search.c b/myisam/ft_boolean_search.c
index 6236f837c42..26aa278d6c9 100644
--- a/myisam/ft_boolean_search.c
+++ b/myisam/ft_boolean_search.c
@@ -69,6 +69,7 @@ struct st_ftb_expr
   float     weight;
   float     cur_weight;
   byte     *quot, *qend;
+  LIST     *phrase;               /* phrase words */
   uint      yesses;               /* number of "yes" words matched */
   uint      nos;                  /* number of "no"  words matched */
   uint      ythresh;              /* number of "yes" words in expr */
@@ -139,6 +140,8 @@ static void _ftb_parse_query(FTB *ftb, byte **start, byte *end,
   FT_WORD     w;
   FTB_WORD   *ftbw;
   FTB_EXPR   *ftbe;
+  FT_WORD    *phrase_word;
+  LIST       *phrase_list;
   uint  extra=HA_FT_WLEN+ftb->info->s->rec_reflength; /* just a shortcut */
 
   if (ftb->state != UNINITIALIZED)
@@ -146,6 +149,7 @@ static void _ftb_parse_query(FTB *ftb, byte **start, byte *end,
 
   param.prev=' ';
   param.quot=up->quot;
+  up->phrase= NULL;
   while ((res=ft_get_word(ftb->charset,start,end,&w,&param)))
   {
     int   r=param.plusminus;
@@ -172,6 +176,14 @@ static void _ftb_parse_query(FTB *ftb, byte **start, byte *end,
         if (param.yesno > 0) up->ythresh++;
         queue_insert(& ftb->queue, (byte *)ftbw);
         ftb->with_scan|=(param.trunc & FTB_FLAG_TRUNC);
+      case 4:
+        if (! up->quot) break;
+        phrase_word= (FT_WORD *)alloc_root(&ftb->mem_root, sizeof(FT_WORD));
+        phrase_list= (LIST *)alloc_root(&ftb->mem_root, sizeof(LIST));
+        phrase_word->pos= w.pos;
+        phrase_word->len= w.len;
+        phrase_list->data= (void *)phrase_word;
+        up->phrase= list_add(up->phrase, phrase_list);
         break;
       case 2: /* left bracket */
         ftbe=(FTB_EXPR *)alloc_root(&ftb->mem_root, sizeof(FTB_EXPR));
@@ -188,7 +200,11 @@ static void _ftb_parse_query(FTB *ftb, byte **start, byte *end,
         param.quot=0;
         break;
       case 3: /* right bracket */
-        if (up->quot) up->qend=param.quot;
+        if (up->quot)
+        {
+          up->qend= param.quot;
+          up->phrase= list_reverse(up->phrase);
+        }
         return;
     }
   }
@@ -433,27 +449,31 @@ err:
 
 /* returns 1 if str0 ~= /\bstr1\b/ */
 static int _ftb_strstr(const byte *s0, const byte *e0,
-                const byte *s1, const byte *e1,
-                CHARSET_INFO *cs)
+                LIST *phrase, CHARSET_INFO *cs)
 {
-  const byte *p0= s0;
-  my_bool s_after= true_word_char(cs, s1[0]);
-  my_bool e_before= true_word_char(cs, e1[-1]);
-  uint p0_len;
-  my_match_t m[2];
+  FT_WORD h_word;
+  const byte *h_start= s0;
+  DBUG_ENTER("_ftb_strstr");
 
-  while (p0 < e0)
+  if (! phrase) DBUG_RETURN(0);
+
+  while (ft_simple_get_word(cs, (byte **)&h_start, e0, &h_word, FALSE))
   {
-    if (cs->coll->instr(cs, p0, e0 - p0, s1, e1 - s1, m, 2) != 2)
-      return(0);
-    if ((!s_after || p0 + m[1].beg == s0 || !true_word_char(cs, p0[m[1].beg-1])) &&
-        (!e_before || p0 + m[1].end == e0 || !true_word_char(cs, p0[m[1].end])))
-      return(1);
-    p0+= m[1].beg;
-    p0+= (p0_len= my_mbcharlen(cs, *(uchar *)p0)) ? p0_len : 1;
+    FT_WORD *n_word;
+    LIST *phrase_element= phrase;
+    const byte *h_start1= h_start;
+    for (;;)
+    {
+      n_word= (FT_WORD *)phrase_element->data;
+      if (my_strnncoll(cs, h_word.pos, h_word.len, n_word->pos, n_word->len))
+        break;
+      if (! (phrase_element= phrase_element->next))
+        DBUG_RETURN(1);
+      if (! ft_simple_get_word(cs, (byte **)&h_start1, e0, &h_word, FALSE))
+        DBUG_RETURN(0);
+    }
   }
-
-  return(0);
+  DBUG_RETURN(0);
 }
 
 
@@ -494,7 +514,7 @@ static void _ftb_climb_the_tree(FTB *ftb, FTB_WORD *ftbw, FT_SEG_ITERATOR *ftsi_
             if (!ftsi.pos)
               continue;
             not_found = ! _ftb_strstr(ftsi.pos, ftsi.pos+ftsi.len,
-                                      ftbe->quot, ftbe->qend, ftb->charset);
+                                      ftbe->phrase, ftb->charset);
           }
           if (not_found) break;
         } /* ftbe->quot */
@@ -642,8 +662,8 @@ float ft_boolean_find_relevance(FT_INFO *ftb, byte *record, uint length)
       continue;
 
     end=ftsi.pos+ftsi.len;
-    while (ft_simple_get_word(ftb->charset,
-                              (byte **) &ftsi.pos, (byte *) end, &word))
+    while (ft_simple_get_word(ftb->charset, (byte **) &ftsi.pos,
+                              (byte *) end, &word, TRUE))
     {
       int a, b, c;
       for (a=0, b=ftb->queue.elements, c=(a+b)/2; b-a>1; c=(a+b)/2)