Fix for bug#2586 Disallow global/session/local as structured var. instance names

3 files changed, 24 insertions, 0 deletions

diff --git a/sql/item_func.cc b/sql/item_func.cc
index 878c4d2ea5f..88c2bf824c6 100644
--- a/sql/item_func.cc
+++ b/sql/item_func.cc
@@ -29,6 +29,16 @@
 #include <ft_global.h>
 
 
+bool check_reserved_words(LEX_STRING *name)
+{
+  if (!my_strcasecmp(system_charset_info, name->str, "GLOBAL") ||
+      !my_strcasecmp(system_charset_info, name->str, "LOCAL") ||
+      !my_strcasecmp(system_charset_info, name->str, "SESSION"))
+    return TRUE;
+  return FALSE;
+}
+
+
 static void my_coll_agg_error(DTCollation &c1, DTCollation &c2,
 			      const char *fname)
 {
@@ -2957,6 +2967,12 @@ Item *get_system_var(THD *thd, enum_var_type var_type, LEX_STRING name,
 			   (uint) strlen(server_version),
 			   system_charset_info);
 
+  if (name.str && component.str && check_reserved_words(&name))
+  {
+    net_printf(thd, ER_SYNTAX_ERROR);
+    return 0;
+  }
+
   Item *item;
   sys_var *var;
   char buff[MAX_SYS_VAR_LENGTH*2+4+8], *pos;
diff --git a/sql/mysql_priv.h b/sql/mysql_priv.h
index 8f86d9990fe..56e1a172d0b 100644
--- a/sql/mysql_priv.h
+++ b/sql/mysql_priv.h
@@ -751,6 +751,9 @@ bool open_log(MYSQL_LOG *log, const char *hostname,
 /* mysqld.cc */
 extern void yyerror(const char*);
 
+/* item_func.cc */
+extern bool check_reserved_words(LEX_STRING *name);
+
 /* strfunc.cc */
 ulonglong find_set(TYPELIB *typelib,const char *x, uint length,
 		   char **err_pos, uint *err_len, bool *set_warning);
diff --git a/sql/sql_yacc.yy b/sql/sql_yacc.yy
index f317219bd38..0f9147b7834 100644
--- a/sql/sql_yacc.yy
+++ b/sql/sql_yacc.yy
@@ -5034,6 +5034,11 @@ internal_variable_name:
 	}
 	| ident '.' ident
 	  {
+            if (check_reserved_words(&$1))
+            {
+              net_printf(YYTHD, ER_SYNTAX_ERROR);
+              YYABORT;
+            }
 	    sys_var *tmp=find_sys_var($3.str, $3.length);
 	    if (!tmp)
 	      YYABORT;