Bug#26402 Server crashes with old-style named table

  Problem: crash on attempt to open a table
  having "#mysql50#" prefix in db or table name.
  Fix: This prefix is reserved for "mysql_upgrade"
  to access 5.0 tables  whose file names are not encoded
  according to "5.1 tablename to filename encoded".
  Don't try open tables whose db name or table name
  has this prefix.


mysql-test/r/show_check.result:
  Adding test case.
mysql-test/t/show_check.test:
  Adding test case.
sql/mysql_priv.h:
  Moving 5.0 prefix declarations into mysql_priv.h
sql/sql_table.cc:
  Moving 5.0 prefix declarations into mysql_priv.h
sql/table.cc:
  Don't try to do "normal" open of tables having '#mysql50#' prefix in
  db or table name. This prefix is reserved to access to unencoded
  table names when upgrading from 5.0 to 5.1.

3 files changed, 21 insertions, 6 deletions

diff --git a/sql/mysql_priv.h b/sql/mysql_priv.h
index 7fb4d95f1f6..921a940834f 100644
--- a/sql/mysql_priv.h
+++ b/sql/mysql_priv.h
@@ -1920,6 +1920,10 @@ uint filename_to_tablename(const char *from, char *to, uint to_length);
 uint tablename_to_filename(const char *from, char *to, uint to_length);
 uint build_table_filename(char *buff, size_t bufflen, const char *db,
                           const char *table, const char *ext, uint flags);
+
+#define MYSQL50_TABLE_NAME_PREFIX         "#mysql50#"
+#define MYSQL50_TABLE_NAME_PREFIX_LENGTH  9
+
 /* Flags for conversion functions. */
 #define FN_FROM_IS_TMP  (1 << 0)
 #define FN_TO_IS_TMP    (1 << 1)
diff --git a/sql/sql_table.cc b/sql/sql_table.cc
index 7c13f9f2c54..4378d69dd9f 100644
--- a/sql/sql_table.cc
+++ b/sql/sql_table.cc
@@ -54,10 +54,6 @@ mysql_prepare_alter_table(THD *thd, TABLE *table,
                           HA_CREATE_INFO *create_info,
                           Alter_info *alter_info);
 
-#define MYSQL50_TABLE_NAME_PREFIX         "#mysql50#"
-#define MYSQL50_TABLE_NAME_PREFIX_LENGTH  9
-
-
 /*
   Translate a file name to a table name (WL #1324).
 
diff --git a/sql/table.cc b/sql/table.cc
index 745f3a2a34e..7076dc2d8f8 100644
--- a/sql/table.cc
+++ b/sql/table.cc
@@ -343,10 +343,25 @@ int open_table_def(THD *thd, TABLE_SHARE *share, uint db_flags)
   strxmov(path, share->normalized_path.str, reg_ext, NullS);
   if ((file= my_open(path, O_RDONLY | O_SHARE, MYF(0))) < 0)
   {
-    if (strchr(share->table_name.str, '@'))
+    /*
+      We don't try to open 5.0 unencoded name, if
+      - non-encoded name contains '@' signs, 
+        because '@' can be misinterpreted.
+        It is not clear if '@' is escape character in 5.1,
+        or a normal character in 5.0.
+        
+      - non-encoded db or table name contain "#mysql50#" prefix.
+        This kind of tables must have been opened only by the
+        my_open() above.
+    */
+    if (strchr(share->table_name.str, '@') ||
+        !strncmp(share->db.str, MYSQL50_TABLE_NAME_PREFIX,
+                 MYSQL50_TABLE_NAME_PREFIX_LENGTH) ||
+        !strncmp(share->table_name.str, MYSQL50_TABLE_NAME_PREFIX,
+                 MYSQL50_TABLE_NAME_PREFIX_LENGTH))
       goto err_not_open;
 
-    /* Try unecoded 5.0 name */
+    /* Try unencoded 5.0 name */
     uint length;
     strxnmov(path, sizeof(path)-1,
              mysql_data_home, "/", share->db.str, "/",