Bug#15776: 32-bit signed int used for length of blob

Based on contributed patch from Martin Friebe, CLA from 2007-02-24.

The parser lacked support for field sizes after signed long,
when it should extend to 2**32-1.

Now, we correct that limitation, and also make the error handling
consistent for casts.


mysql-test/r/type_blob.result:
  Verify that blobs may be created with the size that is already
  documented.
  
  Additionally, test the limits of several other types.
mysql-test/t/type_blob.test:
  Verify that blobs may be created with the size that is already
  documented.
  
  Additionally, test the limits of several other types.
sql/field.cc:
  atoi() insufficient to gauge the length of some fields.  Change
  it to strtoul().
sql/item_create.cc:
  atoi() insufficient to gauge the length of some fields.  Change
  it to strtoul().
  
  If a casted length is too long, raise an error.
sql/share/errmsg.txt:
  Change ER_TOO_BIG_FIELDLENGTH so that it can accept sizes larger
  than 2**15 -- instead, 2**32.
sql/sql_yacc.yy:
  Make lengths take, in addition to NUM, LONG_NUM, ULONGLONG_NUM,
  and DECIMAL_NUM.
sql/unireg.h:
  Define new constant.

5 files changed, 126 insertions, 63 deletions

diff --git a/sql/field.cc b/sql/field.cc
index 3f74210807b..2950f349580 100644
--- a/sql/field.cc
+++ b/sql/field.cc
@@ -8395,8 +8395,20 @@ bool create_field::init(THD *thd, char *fld_name, enum_field_types fld_type,
       (fld_type_modifier & NOT_NULL_FLAG) && fld_type != FIELD_TYPE_TIMESTAMP)
     flags|= NO_DEFAULT_VALUE_FLAG;
 
-  if (fld_length && !(length= (uint) atoi(fld_length)))
-    fld_length= 0; /* purecov: inspected */
+  if (fld_length != 0)
+  {
+    errno= 0;
+    length= strtoul(fld_length, NULL, 10);
+    if (errno != 0)
+    {
+      my_error(ER_TOO_BIG_DISPLAYWIDTH, MYF(0), fld_name, MAX_FIELD_BLOBLENGTH);
+      DBUG_RETURN(TRUE);
+    }
+
+    if (length == 0)
+      fld_length= 0; /* purecov: inspected */
+  }
+
   sign_len= fld_type_modifier & UNSIGNED_FLAG ? 0 : 1;
 
   switch (fld_type) {
diff --git a/sql/item_create.cc b/sql/item_create.cc
index 561613032bc..b7a9a1d7feb 100644
--- a/sql/item_create.cc
+++ b/sql/item_create.cc
@@ -464,8 +464,42 @@ Item *create_func_cast(Item *a, Cast_target cast_type,
   case ITEM_CAST_TIME:		res= new Item_time_typecast(a); break;
   case ITEM_CAST_DATETIME:	res= new Item_datetime_typecast(a); break;
   case ITEM_CAST_DECIMAL:
-    len= c_len ? atoi(c_len) : 0;
-    dec= c_dec ? atoi(c_dec) : 0;
+    if (c_len == NULL)
+    {
+      len= 0;
+    }
+    else
+    {
+      ulong decoded_size;
+      errno= 0;
+      decoded_size= strtoul(c_len, NULL, 10);
+      if (errno != 0)
+      {
+        my_error(ER_TOO_BIG_PRECISION, MYF(0), c_len, a->name,
+                 DECIMAL_MAX_PRECISION);
+        return NULL;
+      }
+      len= decoded_size;
+    }
+
+    if (c_dec == NULL)
+    {
+      dec= 0;
+    }
+    else
+    {
+      ulong decoded_size;
+      errno= 0;
+      decoded_size= strtoul(c_dec, NULL, 10);
+      if ((errno != 0) || (decoded_size > UINT_MAX))
+      {
+        my_error(ER_TOO_BIG_SCALE, MYF(0), c_dec, a->name,
+                 DECIMAL_MAX_SCALE);
+        return NULL;
+      }
+      dec= decoded_size;
+    }
+
     my_decimal_trim(&len, &dec);
     if (len < dec)
     {
@@ -486,8 +520,25 @@ Item *create_func_cast(Item *a, Cast_target cast_type,
     }
     res= new Item_decimal_typecast(a, len, dec);
     break;
+
   case ITEM_CAST_CHAR:
-    len= c_len ? atoi(c_len) : -1;
+    if (c_len == NULL)
+    {
+      len= LL(-1);
+    }
+    else
+    {
+      ulong decoded_size;
+      errno= 0;
+      decoded_size= strtoul(c_len, NULL, 10);
+      if (errno != 0)
+      {
+        my_error(ER_TOO_BIG_DISPLAYWIDTH, MYF(0), "cast as char", MAX_FIELD_BLOBLENGTH);
+        return NULL;
+      }
+      len= decoded_size;
+    }
+
     res= new Item_char_typecast(a, len, cs ? cs : 
 				current_thd->variables.collation_connection);
     break;
diff --git a/sql/share/errmsg.txt b/sql/share/errmsg.txt
index a52ffa8216c..80ed9c788cc 100644
--- a/sql/share/errmsg.txt
+++ b/sql/share/errmsg.txt
@@ -1771,30 +1771,30 @@ ER_BLOB_USED_AS_KEY 42000 S1009
 	swe "En BLOB '%-.64s' kan inte vara nyckel med den anv�nda tabelltypen"
 	ukr "BLOB �������� '%-.64s' �� ���� ���� ������������ � ��������Φ ����� � ����� ��Ц �����æ"
 ER_TOO_BIG_FIELDLENGTH 42000 S1009
-	cze "P-B��li� velk� d�lka sloupce '%-.64s' (nejv�ce %d). Pou�ijte BLOB"
-	dan "For stor feltl�ngde for kolonne '%-.64s' (maks = %d). Brug BLOB i stedet"
-	nla "Te grote kolomlengte voor '%-.64s' (max = %d). Maak hiervoor gebruik van het type BLOB"
-	eng "Column length too big for column '%-.64s' (max = %d); use BLOB or TEXT instead"
-	jps "column '%-.64s' ��,�m�ۂ��� column �̑傫�����������܂�. (�ő� %d �܂�). BLOB �������Ɏg�p���Ă�������.",
-	est "Tulba '%-.64s' pikkus on liiga pikk (maksimaalne pikkus: %d). Kasuta BLOB v�ljat��pi"
-	fre "Champ '%-.64s' trop long (max = %d). Utilisez un BLOB"
-	ger "Feldl�nge f�r Feld '%-.64s' zu gro� (maximal %d). BLOB- oder TEXT-Spaltentyp verwenden!"
-	greek "���� ������ ����� ��� �� ����� '%-.64s' (max = %d). �������� ��������������� ��� ���� BLOB"
-	hun "A(z) '%-.64s' oszlop tul hosszu. (maximum = %d). Hasznaljon BLOB tipust inkabb."
-	ita "La colonna '%-.64s' e` troppo grande (max=%d). Utilizza un BLOB."
-	jpn "column '%-.64s' ��,���ݤ��� column ���礭����¿�����ޤ�. (���� %d �ޤ�). BLOB �򤫤��˻��Ѥ��Ƥ�������."
-	kor "Į�� '%-.64s'�� Į�� ���̰� �ʹ� ��ϴ� (�ִ� = %d). ��ſ� BLOB�� ����ϼ���."
-	nor "For stor n�kkellengde for kolonne '%-.64s' (maks = %d). Bruk BLOB istedenfor"
-	norwegian-ny "For stor nykkellengde for felt '%-.64s' (maks = %d). Bruk BLOB istadenfor"
-	pol "Zbyt du�a d�ugo?� kolumny '%-.64s' (maks. = %d). W zamian u�yj typu BLOB"
-	por "Comprimento da coluna '%-.64s' grande demais (max = %d); use BLOB em seu lugar"
-	rum "Lungimea coloanei '%-.64s' este prea lunga (maximum = %d). Foloseste BLOB mai bine"
-	rus "������� ������� ����� ������� '%-.64s' (�������� = %d). ����������� ��� BLOB ��� TEXT ������ ��������"
-	serbian "Previ�e podataka za kolonu '%-.64s' (maksimum je %d). Upotrebite BLOB polje"
-	slo "Pr�li� ve�k� d�ka pre pole '%-.64s' (maximum = %d). Pou�ite BLOB"
-	spa "Longitud de columna demasiado grande para la columna '%-.64s' (maximo = %d).Usar BLOB en su lugar"
-	swe "F�r stor kolumnl�ngd angiven f�r '%-.64s' (max= %d). Anv�nd en BLOB inst�llet"
-	ukr "������� ������� ������� '%-.64s' (max = %d). ������������ ��� BLOB"
+	cze "P-B��li� velk� d�lka sloupce '%-.64s' (nejv�ce %lu). Pou�ijte BLOB"
+	dan "For stor feltl�ngde for kolonne '%-.64s' (maks = %lu). Brug BLOB i stedet"
+	nla "Te grote kolomlengte voor '%-.64s' (max = %lu). Maak hiervoor gebruik van het type BLOB"
+	eng "Column length too big for column '%-.64s' (max = %lu); use BLOB or TEXT instead"
+	jps "column '%-.64s' ��,�m�ۂ��� column �̑傫�����������܂�. (�ő� %lu �܂�). BLOB �������Ɏg�p���Ă�������.",
+	est "Tulba '%-.64s' pikkus on liiga pikk (maksimaalne pikkus: %lu). Kasuta BLOB v�ljat��pi"
+	fre "Champ '%-.64s' trop long (max = %lu). Utilisez un BLOB"
+	ger "Feldl�nge f�r Feld '%-.64s' zu gro� (maximal %lu). BLOB- oder TEXT-Spaltentyp verwenden!"
+	greek "���� ������ ����� ��� �� ����� '%-.64s' (max = %lu). �������� ��������������� ��� ���� BLOB"
+	hun "A(z) '%-.64s' oszlop tul hosszu. (maximum = %lu). Hasznaljon BLOB tipust inkabb."
+	ita "La colonna '%-.64s' e` troppo grande (max=%lu). Utilizza un BLOB."
+	jpn "column '%-.64s' ��,���ݤ��� column ���礭����¿�����ޤ�. (���� %lu �ޤ�). BLOB �򤫤��˻��Ѥ��Ƥ�������."
+	kor "Į�� '%-.64s'�� Į�� ���̰� �ʹ� ��ϴ� (�ִ� = %lu). ��ſ� BLOB�� ����ϼ���."
+	nor "For stor n�kkellengde for kolonne '%-.64s' (maks = %lu). Bruk BLOB istedenfor"
+	norwegian-ny "For stor nykkellengde for felt '%-.64s' (maks = %lu). Bruk BLOB istadenfor"
+	pol "Zbyt du�a d�ugo?� kolumny '%-.64s' (maks. = %lu). W zamian u�yj typu BLOB"
+	por "Comprimento da coluna '%-.64s' grande demais (max = %lu); use BLOB em seu lugar"
+	rum "Lungimea coloanei '%-.64s' este prea lunga (maximum = %lu). Foloseste BLOB mai bine"
+	rus "������� ������� ����� ������� '%-.64s' (�������� = %lu). ����������� ��� BLOB ��� TEXT ������ ��������"
+	serbian "Previ�e podataka za kolonu '%-.64s' (maksimum je %lu). Upotrebite BLOB polje"
+	slo "Pr�li� ve�k� d�ka pre pole '%-.64s' (maximum = %lu). Pou�ite BLOB"
+	spa "Longitud de columna demasiado grande para la columna '%-.64s' (maximo = %lu).Usar BLOB en su lugar"
+	swe "F�r stor kolumnl�ngd angiven f�r '%-.64s' (max= %lu). Anv�nd en BLOB inst�llet"
+	ukr "������� ������� ������� '%-.64s' (max = %lu). ������������ ��� BLOB"
 ER_WRONG_AUTO_KEY 42000 S1009
 	cze "M-B��ete m�t pouze jedno AUTO pole a to mus� b�t definov�no jako kl��"
 	dan "Der kan kun specificeres eet AUTO_INCREMENT-felt, og det skal v�re indekseret"
@@ -5508,11 +5508,11 @@ ER_SP_NO_RECURSION
         eng "Recursive stored functions and triggers are not allowed."
 	ger "Rekursive gespeicherte Routinen und Triggers sind nicht erlaubt"
 ER_TOO_BIG_SCALE 42000 S1009
-        eng "Too big scale %d specified for column '%-.64s'. Maximum is %d."
-	ger "Zu gro�er Skalierungsfaktor %d f�r Feld '%-.64s' angegeben. Maximum ist %d"
+        eng "Too big scale %lu specified for column '%-.64s'. Maximum is %d."
+	ger "Zu gro�er Skalierungsfaktor %lu f�r Feld '%-.64s' angegeben. Maximum ist %d"
 ER_TOO_BIG_PRECISION 42000 S1009
-        eng "Too big precision %d specified for column '%-.64s'. Maximum is %d."
-	ger "Zu gro�e Genauigkeit %d f�r Feld '%-.64s' angegeben. Maximum ist %d"
+        eng "Too big precision %lu specified for column '%-.64s'. Maximum is %lu."
+	ger "Zu gro�e Genauigkeit %lu f�r Feld '%-.64s' angegeben. Maximum ist %lu"
 ER_M_BIGGER_THAN_D 42000 S1009
         eng "For float(M,D), double(M,D) or decimal(M,D), M must be >= D (column '%-.64s')."
 	ger "F�r FLOAT(M,D), DOUBLE(M,D) oder DECIMAL(M,D) muss M >= D sein (Feld '%-.64s')"
@@ -5550,8 +5550,8 @@ ER_WARN_CANT_DROP_DEFAULT_KEYCACHE
 	eng "Cannot drop default keycache"
         ger "Der vorgabem��ige Schl�ssel-Cache kann nicht gel�scht werden"
 ER_TOO_BIG_DISPLAYWIDTH 42000 S1009
-	eng "Display width out of range for column '%-.64s' (max = %d)"
-	ger "Anzeigebreite au�erhalb des zul�ssigen Bereichs f�r Spalte '%-.64s' (Maximum: %d)"
+	eng "Display width out of range for column '%-.64s' (max = %lu)"
+	ger "Anzeigebreite au�erhalb des zul�ssigen Bereichs f�r Spalte '%-.64s' (Maximum: %lu)"
 ER_XAER_DUPID XAE08
         eng "XAER_DUPID: The XID already exists"
 	ger "XAER_DUPID: Die XID existiert bereits"
diff --git a/sql/sql_yacc.yy b/sql/sql_yacc.yy
index 638da3b1bb0..c270e005454 100644
--- a/sql/sql_yacc.yy
+++ b/sql/sql_yacc.yy
@@ -1171,7 +1171,7 @@ bool my_yyoverflow(short **a, YYSTYPE **b, ulong *yystacksize);
 	single_multi table_wild_list table_wild_one opt_wild
 	union_clause union_list
 	precision subselect_start opt_and charset
-	subselect_end select_var_list select_var_list_init help opt_len
+	subselect_end select_var_list select_var_list_init help opt_field_length field_length
 	opt_extended_describe
         prepare prepare_src execute deallocate
 	statement sp_suid
@@ -3010,7 +3010,7 @@ udf_type:
 
 field_list:
 	  field_list_item
-	| field_list ',' field_list_item;
+	| field_list ',' field_list_item; /* FIXME:  Should this be backward? */
 
 
 field_list_item:
@@ -3111,45 +3111,38 @@ field_spec:
 	};
 
 type:
-	int_type opt_len field_options	{ $$=$1; }
+	int_type opt_field_length field_options	{ $$=$1; }
 	| real_type opt_precision field_options { $$=$1; }
 	| FLOAT_SYM float_options field_options { $$=FIELD_TYPE_FLOAT; }
 	| BIT_SYM			{ Lex->length= (char*) "1";
 					  $$=FIELD_TYPE_BIT; }
-	| BIT_SYM '(' NUM ')'		{ Lex->length= $3.str;
-					  $$=FIELD_TYPE_BIT; }
+	| BIT_SYM field_length		{ $$=FIELD_TYPE_BIT; }
 	| BOOL_SYM			{ Lex->length=(char*) "1";
 					  $$=FIELD_TYPE_TINY; }
 	| BOOLEAN_SYM			{ Lex->length=(char*) "1";
 					  $$=FIELD_TYPE_TINY; }
-	| char '(' NUM ')' opt_binary	{ Lex->length=$3.str;
-					  $$=FIELD_TYPE_STRING; }
+	| char field_length opt_binary	{ $$=FIELD_TYPE_STRING; }
 	| char opt_binary		{ Lex->length=(char*) "1";
 					  $$=FIELD_TYPE_STRING; }
-	| nchar '(' NUM ')' opt_bin_mod	{ Lex->length=$3.str;
-					  $$=FIELD_TYPE_STRING;
+	| nchar field_length opt_bin_mod { $$=FIELD_TYPE_STRING;
 					  Lex->charset=national_charset_info; }
 	| nchar opt_bin_mod		{ Lex->length=(char*) "1";
 					  $$=FIELD_TYPE_STRING;
 					  Lex->charset=national_charset_info; }
-	| BINARY '(' NUM ')'		{ Lex->length=$3.str;
-					  Lex->charset=&my_charset_bin;
+	| BINARY field_length		{ Lex->charset=&my_charset_bin;
 					  $$=FIELD_TYPE_STRING; }
 	| BINARY			{ Lex->length= (char*) "1";
 					  Lex->charset=&my_charset_bin;
 					  $$=FIELD_TYPE_STRING; }
-	| varchar '(' NUM ')' opt_binary { Lex->length=$3.str;
-					  $$= MYSQL_TYPE_VARCHAR; }
-	| nvarchar '(' NUM ')' opt_bin_mod { Lex->length=$3.str;
-					  $$= MYSQL_TYPE_VARCHAR;
+	| varchar field_length opt_binary { $$= MYSQL_TYPE_VARCHAR; }
+	| nvarchar field_length opt_bin_mod { $$= MYSQL_TYPE_VARCHAR;
 					  Lex->charset=national_charset_info; }
-	| VARBINARY '(' NUM ')' 	{ Lex->length=$3.str;
-					  Lex->charset=&my_charset_bin;
+	| VARBINARY field_length 	{ Lex->charset=&my_charset_bin;
 					  $$= MYSQL_TYPE_VARCHAR; }
-	| YEAR_SYM opt_len field_options { $$=FIELD_TYPE_YEAR; }
+	| YEAR_SYM opt_field_length field_options { $$=FIELD_TYPE_YEAR; }
 	| DATE_SYM			{ $$=FIELD_TYPE_DATE; }
 	| TIME_SYM			{ $$=FIELD_TYPE_TIME; }
-	| TIMESTAMP opt_len
+	| TIMESTAMP opt_field_length
 	  {
 	    if (YYTHD->variables.sql_mode & MODE_MAXDB)
 	      $$=FIELD_TYPE_DATETIME;
@@ -3165,7 +3158,7 @@ type:
 	| DATETIME			{ $$=FIELD_TYPE_DATETIME; }
 	| TINYBLOB			{ Lex->charset=&my_charset_bin;
 					  $$=FIELD_TYPE_TINY_BLOB; }
-	| BLOB_SYM opt_len		{ Lex->charset=&my_charset_bin;
+	| BLOB_SYM opt_field_length		{ Lex->charset=&my_charset_bin;
 					  $$=FIELD_TYPE_BLOB; }
 	| spatial_type
           {
@@ -3187,7 +3180,7 @@ type:
 					  $$=FIELD_TYPE_MEDIUM_BLOB; }
 	| LONG_SYM varchar opt_binary	{ $$=FIELD_TYPE_MEDIUM_BLOB; }
 	| TINYTEXT opt_binary		{ $$=FIELD_TYPE_TINY_BLOB; }
-	| TEXT_SYM opt_len opt_binary	{ $$=FIELD_TYPE_BLOB; }
+	| TEXT_SYM opt_field_length opt_binary	{ $$=FIELD_TYPE_BLOB; }
 	| MEDIUMTEXT opt_binary		{ $$=FIELD_TYPE_MEDIUM_BLOB; }
 	| LONGTEXT opt_binary		{ $$=FIELD_TYPE_LONG_BLOB; }
 	| DECIMAL_SYM float_options field_options
@@ -3260,7 +3253,7 @@ real_type:
 
 float_options:
         /* empty */		{ Lex->dec=Lex->length= (char*)0; }
-        | '(' NUM ')'		{ Lex->length=$2.str; Lex->dec= (char*)0; }
+        | field_length		{ Lex->dec= (char*)0; }
 	| precision		{};
 
 precision:
@@ -3283,9 +3276,15 @@ field_option:
 	| UNSIGNED	{ Lex->type|= UNSIGNED_FLAG;}
 	| ZEROFILL	{ Lex->type|= UNSIGNED_FLAG | ZEROFILL_FLAG; };
 
-opt_len:
-	/* empty */	{ Lex->length=(char*) 0; } /* use default length */
-	| '(' NUM ')'	{ Lex->length= $2.str; };
+opt_field_length:
+        /* empty */             { Lex->length=(char*) NULL; } /* use default length */
+        | field_length          {};
+
+field_length:
+        '(' LONG_NUM ')'      { Lex->length= $2.str; }
+        | '(' ULONGLONG_NUM ')' { Lex->length= $2.str; }
+        | '(' DECIMAL_NUM ')'   { Lex->length= $2.str; }
+        | '(' NUM ')'           { Lex->length= $2.str; };
 
 opt_precision:
 	/* empty */	{}
@@ -5466,9 +5465,9 @@ in_sum_expr:
 	};
 
 cast_type:
-        BINARY opt_len		{ $$=ITEM_CAST_CHAR; Lex->charset= &my_charset_bin; Lex->dec= 0; }
-        | CHAR_SYM opt_len opt_binary	{ $$=ITEM_CAST_CHAR; Lex->dec= 0; }
-	| NCHAR_SYM opt_len	{ $$=ITEM_CAST_CHAR; Lex->charset= national_charset_info; Lex->dec=0; }
+        BINARY opt_field_length		{ $$=ITEM_CAST_CHAR; Lex->charset= &my_charset_bin; Lex->dec= 0; }
+        | CHAR_SYM opt_field_length opt_binary	{ $$=ITEM_CAST_CHAR; Lex->dec= 0; }
+	| NCHAR_SYM opt_field_length	{ $$=ITEM_CAST_CHAR; Lex->charset= national_charset_info; Lex->dec=0; }
         | SIGNED_SYM		{ $$=ITEM_CAST_SIGNED_INT; Lex->charset= NULL; Lex->dec=Lex->length= (char*)0; }
         | SIGNED_SYM INT_SYM	{ $$=ITEM_CAST_SIGNED_INT; Lex->charset= NULL; Lex->dec=Lex->length= (char*)0; }
         | UNSIGNED		{ $$=ITEM_CAST_UNSIGNED_INT; Lex->charset= NULL; Lex->dec=Lex->length= (char*)0; }
diff --git a/sql/unireg.h b/sql/unireg.h
index 81ca18c1d32..0ab2a40048b 100644
--- a/sql/unireg.h
+++ b/sql/unireg.h
@@ -60,6 +60,7 @@
 #define MAX_MBWIDTH		3		/* Max multibyte sequence */
 #define MAX_FIELD_CHARLENGTH	255
 #define MAX_FIELD_VARCHARLENGTH	65535
+#define MAX_FIELD_BLOBLENGTH    UINT_MAX
 #define CONVERT_IF_BIGGER_TO_BLOB 512		/* Used for CREATE ... SELECT */
 
 /* Max column width +1 */