merge mysql-5.1->mysql-5.1-security

12 files changed, 69 insertions, 39 deletions

diff --git a/sql/ha_partition.cc b/sql/ha_partition.cc
index 7c7cf5a4302..77eb8285245 100644
--- a/sql/ha_partition.cc
+++ b/sql/ha_partition.cc
@@ -1,5 +1,5 @@
 /*
-  Copyright (c) 2005, 2011, Oracle and/or its affiliates. All rights reserved.
+  Copyright (c) 2005, 2012, Oracle and/or its affiliates. All rights reserved.
 
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
@@ -6494,20 +6494,20 @@ int ha_partition::add_index(TABLE *table_arg, KEY *key_info, uint num_of_keys)
   return ret;
 err:
   if (file > m_file)
-  {

-    uint *key_numbers= (uint*) ha_thd()->alloc(sizeof(uint) * num_of_keys);

-    KEY *old_key_info= table_arg->key_info;

-    uint i;

-    /* Use the newly added key_info as table->key_info to remove them. */

-    for (i= 0; i < num_of_keys; i++)

-      key_numbers[i]= i;

-    table_arg->key_info= key_info;

-    while (--file >= m_file)

-    {

-      (void) (*file)->prepare_drop_index(table_arg, key_numbers, num_of_keys);

-      (void) (*file)->final_drop_index(table_arg);

-    }

-    table_arg->key_info= old_key_info;

+  {
+    uint *key_numbers= (uint*) ha_thd()->alloc(sizeof(uint) * num_of_keys);
+    KEY *old_key_info= table_arg->key_info;
+    uint i;
+    /* Use the newly added key_info as table->key_info to remove them. */
+    for (i= 0; i < num_of_keys; i++)
+      key_numbers[i]= i;
+    table_arg->key_info= key_info;
+    while (--file >= m_file)
+    {
+      (void) (*file)->prepare_drop_index(table_arg, key_numbers, num_of_keys);
+      (void) (*file)->final_drop_index(table_arg);
+    }
+    table_arg->key_info= old_key_info;
   }
   return ret;
 }
diff --git a/sql/ha_partition.h b/sql/ha_partition.h
index 46e2f447a47..7e6b062846a 100644
--- a/sql/ha_partition.h
+++ b/sql/ha_partition.h
@@ -1,5 +1,5 @@
 /*
-   Copyright (c) 2005, 2011, Oracle and/or its affiliates. All rights reserved.
+   Copyright (c) 2005, 2012, Oracle and/or its affiliates. All rights reserved.
 
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
@@ -219,9 +219,9 @@ public:
   */
     ha_partition(handlerton *hton, TABLE_SHARE * table);
     ha_partition(handlerton *hton, partition_info * part_info);
-    ha_partition(handlerton *hton, TABLE_SHARE *share,

-                 partition_info *part_info_arg,

-                 ha_partition *clone_arg,

+    ha_partition(handlerton *hton, TABLE_SHARE *share,
+                 partition_info *part_info_arg,
+                 ha_partition *clone_arg,
                  MEM_ROOT *clone_mem_root_arg);
    ~ha_partition();
   /*
@@ -553,6 +553,20 @@ public:
   virtual int extra(enum ha_extra_function operation);
   virtual int extra_opt(enum ha_extra_function operation, ulong cachesize);
   virtual int reset(void);
+  /*
+    Do not allow caching of partitioned tables, since we cannot return
+    a callback or engine_data that would work for a generic engine.
+  */
+  virtual my_bool register_query_cache_table(THD *thd, char *table_key,
+                                             uint key_length,
+                                             qc_engine_callback
+                                               *engine_callback,
+                                             ulonglong *engine_data)
+  {
+    *engine_callback= NULL;
+    *engine_data= 0;
+    return FALSE;
+  }
 
 private:
   static const uint NO_CURRENT_PART_ID;
diff --git a/sql/item.cc b/sql/item.cc
index f80d862e856..2a7d2453889 100644
--- a/sql/item.cc
+++ b/sql/item.cc
@@ -3085,7 +3085,7 @@ String *Item_param::val_str(String* str)
     that binary log contains wrong statement 
 */
 
-const String *Item_param::query_val_str(String* str) const
+const String *Item_param::query_val_str(THD *thd, String* str) const
 {
   switch (state) {
   case INT_VALUE:
@@ -3123,7 +3123,8 @@ const String *Item_param::query_val_str(String* str) const
   case LONG_DATA_VALUE:
     {
       str->length(0);
-      append_query_string(value.cs_info.character_set_client, &str_value, str);
+      append_query_string(thd, value.cs_info.character_set_client, &str_value,
+                          str);
       break;
     }
   case NULL_VALUE:
@@ -3256,7 +3257,7 @@ void Item_param::print(String *str, enum_query_type query_type)
     char buffer[STRING_BUFFER_USUAL_SIZE];
     String tmp(buffer, sizeof(buffer), &my_charset_bin);
     const String *res;
-    res= query_val_str(&tmp);
+    res= query_val_str(current_thd, &tmp);
     str->append(*res);
   }
 }
diff --git a/sql/item.h b/sql/item.h
index 8d7ad3c41d3..1934e005776 100644
--- a/sql/item.h
+++ b/sql/item.h
@@ -1703,7 +1703,7 @@ public:
   */
   void (*set_param_func)(Item_param *param, uchar **pos, ulong len);
 
-  const String *query_val_str(String *str) const;
+  const String *query_val_str(THD *thd, String *str) const;
 
   bool convert_str_value(THD *thd);
 
diff --git a/sql/item_cmpfunc.h b/sql/item_cmpfunc.h
index 4d8cadfcce9..b185bf02790 100644
--- a/sql/item_cmpfunc.h
+++ b/sql/item_cmpfunc.h
@@ -254,7 +254,7 @@ public:
   Item_in_optimizer(Item *a, Item_in_subselect *b):
     Item_bool_func(a, my_reinterpret_cast(Item *)(b)), cache(0),
     save_cache(0), result_for_null_param(UNKNOWN)
-  {}
+  { with_subselect= true; }
   bool fix_fields(THD *, Item **);
   bool fix_left(THD *thd, Item **ref);
   bool is_null();
diff --git a/sql/log_event.cc b/sql/log_event.cc
index fac3e3f264b..427f27650dd 100644
--- a/sql/log_event.cc
+++ b/sql/log_event.cc
@@ -572,7 +572,7 @@ char *str_to_hex(char *to, const char *from, uint len)
 */
 
 int
-append_query_string(CHARSET_INFO *csinfo,
+append_query_string(THD *thd, CHARSET_INFO *csinfo,
                     String const *from, String *to)
 {
   char *beg, *ptr;
@@ -587,9 +587,26 @@ append_query_string(CHARSET_INFO *csinfo,
   else
   {
     *ptr++= '\'';
-    ptr+= escape_string_for_mysql(csinfo, ptr, 0,
-                                  from->ptr(), from->length());
-    *ptr++='\'';
+    if (!(thd->variables.sql_mode & MODE_NO_BACKSLASH_ESCAPES))
+    {
+      ptr+= escape_string_for_mysql(csinfo, ptr, 0,
+                                    from->ptr(), from->length());
+    }
+    else
+    {
+      const char *frm_str= from->ptr();
+
+      for (; frm_str < (from->ptr() + from->length()); frm_str++)
+      {
+        /* Using '' way to represent "'" */
+        if (*frm_str == '\'')
+          *ptr++= *frm_str;
+
+        *ptr++= *frm_str;
+      }
+    }
+
+    *ptr++= '\'';
   }
   to->length(orig_len + ptr - beg);
   return 0;
diff --git a/sql/mysql_priv.h b/sql/mysql_priv.h
index 4b89a7a7961..359e84a3370 100644
--- a/sql/mysql_priv.h
+++ b/sql/mysql_priv.h
@@ -799,7 +799,7 @@ bool delete_precheck(THD *thd, TABLE_LIST *tables);
 bool insert_precheck(THD *thd, TABLE_LIST *tables);
 bool create_table_precheck(THD *thd, TABLE_LIST *tables,
                            TABLE_LIST *create_table);
-int append_query_string(CHARSET_INFO *csinfo,
+int append_query_string(THD *thd, CHARSET_INFO *csinfo,
                         String const *from, String *to);
 
 void get_default_definer(THD *thd, LEX_USER *definer);
diff --git a/sql/mysqld.cc b/sql/mysqld.cc
index a37479dc4b4..4a80fd043c8 100644
--- a/sql/mysqld.cc
+++ b/sql/mysqld.cc
@@ -2468,10 +2468,6 @@ static void check_data_home(const char *path)
 
 #endif /*__WIN__ || __NETWARE */
 
-#ifdef HAVE_LINUXTHREADS
-#define UNSAFE_DEFAULT_LINUX_THREADS 200
-#endif
-
 
 #if BACKTRACE_DEMANGLE
 #include <cxxabi.h>
diff --git a/sql/signal_handler.cc b/sql/signal_handler.cc
index 54b456ec2c4..121338c31d2 100644
--- a/sql/signal_handler.cc
+++ b/sql/signal_handler.cc
@@ -131,6 +131,7 @@ extern "C" sig_handler handle_fatal_signal(int sig)
     "Hope that's ok; if not, decrease some variables in the equation.\n\n");
 
 #if defined(HAVE_LINUXTHREADS)
+#define UNSAFE_DEFAULT_LINUX_THREADS 200
   if (sizeof(char*) == 4 && thread_count > UNSAFE_DEFAULT_LINUX_THREADS)
   {
     my_safe_printf_stderr(
diff --git a/sql/sp_head.cc b/sql/sp_head.cc
index dec76615ec7..7eef9f5ab28 100644
--- a/sql/sp_head.cc
+++ b/sql/sp_head.cc
@@ -157,7 +157,7 @@ sp_get_item_value(THD *thd, Item *item, String *str)
         buf.append(result->charset()->csname);
         if (cs->escape_with_backslash_is_dangerous)
           buf.append(' ');
-        append_query_string(cs, result, &buf);
+        append_query_string(thd, cs, result, &buf);
         buf.append(" COLLATE '");
         buf.append(item->collation.collation->name);
         buf.append('\'');
diff --git a/sql/sql_parse.cc b/sql/sql_parse.cc
index 989c3e0f42f..0f190809ab9 100644
--- a/sql/sql_parse.cc
+++ b/sql/sql_parse.cc
@@ -1734,8 +1734,9 @@ void log_slow_statement(THD *thd)
     ulonglong end_utime_of_query= thd->current_utime();
     thd_proc_info(thd, "logging slow query");
 
-    if (((end_utime_of_query - thd->utime_after_lock) >
-         thd->variables.long_query_time ||
+    if ((((end_utime_of_query > thd->utime_after_lock) &&
+          ((end_utime_of_query - thd->utime_after_lock) >
+           thd->variables.long_query_time)) ||
          ((thd->server_status &
            (SERVER_QUERY_NO_INDEX_USED | SERVER_QUERY_NO_GOOD_INDEX_USED)) &&
           opt_log_queries_not_using_indexes &&
diff --git a/sql/sql_prepare.cc b/sql/sql_prepare.cc
index ec7a7fb73b8..98379dba9ba 100644
--- a/sql/sql_prepare.cc
+++ b/sql/sql_prepare.cc
@@ -795,7 +795,7 @@ static bool insert_params_with_log(Prepared_statement *stmt, uchar *null_array,
     */
     else if (! is_param_long_data_type(param))
       DBUG_RETURN(1);
-    res= param->query_val_str(&str);
+    res= param->query_val_str(thd, &str);
     if (param->convert_str_value(thd))
       DBUG_RETURN(1);                           /* out of memory */
 
@@ -969,7 +969,7 @@ static bool emb_insert_params_with_log(Prepared_statement *stmt,
           DBUG_RETURN(1);
       }
     }
-    res= param->query_val_str(&str);
+    res= param->query_val_str(thd, &str);
     if (param->convert_str_value(thd))
       DBUG_RETURN(1);                           /* out of memory */
 
@@ -1115,7 +1115,7 @@ static bool insert_params_from_vars_with_log(Prepared_statement *stmt,
     setup_one_conversion_function(thd, param, param->param_type);
     if (param->set_from_user_var(thd, entry))
       DBUG_RETURN(1);
-    val= param->query_val_str(&buf);
+    val= param->query_val_str(thd, &buf);
 
     if (param->convert_str_value(thd))
       DBUG_RETURN(1);                           /* out of memory */