prevent using references on sum function (except HAVING clouse of current select) and forward references

include/mysqld_error.h:
  new error message
mysql-test/r/subselect.result:
  new error message
mysql-test/t/subselect.test:
  new error message
sql/item.cc:
  fix_fields indicator
  test on incorrect references
sql/item.h:
  fix_fields indicator
sql/item_cmpfunc.cc:
  fix_fields indicator
sql/item_func.cc:
  fix_fields indicator
sql/item_func.h:
  fix_fields indicator
sql/item_strfunc.cc:
  fix_fields indicator
sql/item_subselect.cc:
  fix_fields indicator
sql/item_sum.cc:
  fix_fields indicator
sql/item_sum.h:
  fix_fields indicator
sql/item_uniq.h:
  fix_fields indicator
sql/share/czech/errmsg.txt:
  new error message
sql/share/danish/errmsg.txt:
  new error message
sql/share/dutch/errmsg.txt:
  new error message
sql/share/english/errmsg.txt:
  new error message
sql/share/estonian/errmsg.txt:
  new error message
sql/share/french/errmsg.txt:
  new error message
sql/share/german/errmsg.txt:
  new error message
sql/share/greek/errmsg.txt:
  new error message
sql/share/hungarian/errmsg.txt:
  new error message
sql/share/italian/errmsg.txt:
  new error message
sql/share/japanese/errmsg.txt:
  new error message
sql/share/korean/errmsg.txt:
  new error message
sql/share/norwegian-ny/errmsg.txt:
  new error message
sql/share/norwegian/errmsg.txt:
  new error message
sql/share/polish/errmsg.txt:
  new error message
sql/share/portuguese/errmsg.txt:
  new error message
sql/share/romanian/errmsg.txt:
  new error message
sql/share/russian/errmsg.txt:
  new error message
sql/share/serbian/errmsg.txt:
  new error message
sql/share/slovak/errmsg.txt:
  new error message
sql/share/spanish/errmsg.txt:
  new error message
sql/share/swedish/errmsg.txt:
  new error message
sql/share/ukrainian/errmsg.txt:
  new error message

33 files changed, 83 insertions, 3 deletions

diff --git a/sql/item.cc b/sql/item.cc
index 48ec11d02c2..b56486c5027 100644
--- a/sql/item.cc
+++ b/sql/item.cc
@@ -34,7 +34,8 @@ void item_init(void)
   item_user_lock_init();
 }
 
-Item::Item()
+Item::Item():
+  fixed(0)
 {
   marker=0;
   maybe_null=null_value=with_sum_func=unsigned_flag=0;
@@ -139,6 +140,7 @@ CHARSET_INFO * Item::thd_charset() const
 Item_field::Item_field(Field *f) :Item_ident(NullS,f->table_name,f->field_name)
 {
   set_field(f);
+  fixed= 1; // This item is not needed in fix_fields
 }
 
 
@@ -438,6 +440,7 @@ bool Item::fix_fields(THD *thd,
 		      struct st_table_list *list,
 		      Item ** ref)
 {
+  fixed= 1;
   return 0;
 }
 
@@ -459,23 +462,48 @@ bool Item_field::fix_fields(THD *thd, TABLE_LIST *tables, Item **ref)
       */
       SELECT_LEX *last= 0;
       
+      Item **refer= (Item **)not_found_item;
       // Prevent using outer fields in subselects, that is not supported now
       if (thd->lex.current_select->linkage != DERIVED_TABLE_TYPE)
 	for (SELECT_LEX *sl= thd->lex.current_select->outer_select();
 	     sl;
 	     sl= sl->outer_select())
+	{
 	  if ((tmp= find_field_in_tables(thd, this,
 					 (last= sl)->get_table_list(),
 					 0)) != not_found_field)
 	    break;
+	  if((refer= find_item_in_list(this, (last= sl)->item_list,
+				       REPORT_EXCEPT_NOT_FOUND)) !=
+	     (Item **)not_found_item)
+	    break;
+	  
+	}
       if (!tmp)
 	return -1;
-      else if (tmp == not_found_field)
+      else if (!refer)
+	return 1;
+      else if (tmp == not_found_field && refer == (Item **)not_found_item)
       {
 	// call to return error code
 	find_field_in_tables(thd, this, tables, 1);
 	return -1;
       }
+      else if (refer != (Item **)not_found_item)
+      {
+	Item_ref *r;
+	*ref= r= new Item_ref((char *)db_name, (char *)table_name,
+			   (char *)field_name);
+	if (!r)
+	  return 1;
+	int res;
+	if ((res= r->fix_fields(thd, tables, ref)))
+	  return res;
+	r->depended_from= last;
+	thd->lex.current_select->mark_as_dependent(last);
+	thd->add_possible_loop(r);
+	return 0;
+      }
       else
       {
 	depended_from= last;
@@ -507,6 +535,7 @@ bool Item_field::fix_fields(THD *thd, TABLE_LIST *tables, Item **ref)
       return 1;
     return (*ref)->fix_fields(thd, tables, ref);
   }
+  fixed= 1;
   return 0;
 }
 
@@ -885,6 +914,19 @@ bool Item_ref::fix_fields(THD *thd,TABLE_LIST *tables, Item **reference)
     maybe_null= (*ref)->maybe_null;
     decimals=	(*ref)->decimals;
   }
+  if (((*ref)->with_sum_func && 
+       (depended_from || 
+	!(thd->lex.current_select->linkage != GLOBAL_OPTIONS_TYPE &&
+	  thd->lex.current_select->select_lex()->having_fix_field))) ||
+      !(*ref)->fixed)
+  {
+    my_error(ER_ILLEGAL_REFERENCE, MYF(0), name, 
+	     ((*ref)->with_sum_func?
+	      "reference on group function":
+	      "forward reference in item list"));
+    return 1;
+  }
+  fixed= 1;
   return 0;
 }
 
diff --git a/sql/item.h b/sql/item.h
index c67c16c50ad..7228b5dc785 100644
--- a/sql/item.h
+++ b/sql/item.h
@@ -46,6 +46,7 @@ public:
   my_bool null_value;			/* if item is null */
   my_bool unsigned_flag;
   my_bool with_sum_func;
+  my_bool fixed;                        /* If item fixed with fix_fields */
 
   // alloc & destruct is done as start of select using sql_alloc
   Item();
diff --git a/sql/item_cmpfunc.cc b/sql/item_cmpfunc.cc
index 74eb5734ecf..a3c8328bb06 100644
--- a/sql/item_cmpfunc.cc
+++ b/sql/item_cmpfunc.cc
@@ -1152,6 +1152,7 @@ Item_cond::fix_fields(THD *thd, TABLE_LIST *tables, Item **ref)
   if (thd)
     thd->cond_count+=list.elements;
   fix_length_and_dec();
+  fixed= 1;
   return 0;
 }
 
@@ -1425,6 +1426,7 @@ Item_func_regex::fix_fields(THD *thd, TABLE_LIST *tables, Item **ref)
   }
   else
     maybe_null=1;
+  fixed= 1;
   return 0;
 }
 
diff --git a/sql/item_func.cc b/sql/item_func.cc
index aa39b3cc857..140d432b794 100644
--- a/sql/item_func.cc
+++ b/sql/item_func.cc
@@ -123,6 +123,7 @@ Item_func::fix_fields(THD *thd, TABLE_LIST *tables, Item **ref)
     }
   }
   fix_length_and_dec();
+  fixed= 1;
   return 0;
 }
 
diff --git a/sql/item_func.h b/sql/item_func.h
index 581809fc9cb..4dd9088c5c8 100644
--- a/sql/item_func.h
+++ b/sql/item_func.h
@@ -742,6 +742,7 @@ public:
     bool res= udf.fix_fields(thd, tables, this, arg_count, args);
     used_tables_cache= udf.used_tables_cache;
     const_item_cache= udf.const_item_cache;
+    fixed= 1;
     return res;
   }
   Item_result result_type () const { return udf.result_type(); }
diff --git a/sql/item_strfunc.cc b/sql/item_strfunc.cc
index 1a561c9eb34..6a0aaa3b032 100644
--- a/sql/item_strfunc.cc
+++ b/sql/item_strfunc.cc
@@ -2065,6 +2065,7 @@ bool Item_func_conv_charset::fix_fields(THD *thd,struct st_table_list *tables, I
   const_item_cache=args[0]->const_item();
   set_charset(conv_charset);
   fix_length_and_dec();
+  fixed= 1;
   return 0;
 }
 
@@ -2099,6 +2100,7 @@ bool Item_func_set_collation::fix_fields(THD *thd,struct st_table_list *tables,
   used_tables_cache=args[0]->used_tables();
   const_item_cache=args[0]->const_item();
   fix_length_and_dec();
+  fixed= 1;
   return 0;
 }
 
diff --git a/sql/item_subselect.cc b/sql/item_subselect.cc
index 1f1944026ef..01ce5fad4a6 100644
--- a/sql/item_subselect.cc
+++ b/sql/item_subselect.cc
@@ -92,6 +92,7 @@ bool Item_subselect::fix_fields(THD *thd, TABLE_LIST *tables, Item **ref)
     }
     fix_length_and_dec();
   }
+  fixed= 1;
   return res;
 }
 
diff --git a/sql/item_sum.cc b/sql/item_sum.cc
index db4c45fc412..9c7a73a6904 100644
--- a/sql/item_sum.cc
+++ b/sql/item_sum.cc
@@ -135,6 +135,7 @@ Item_sum_num::fix_fields(THD *thd, TABLE_LIST *tables, Item **ref)
   null_value=1;
   fix_length_and_dec();
   thd->allow_sum_func=1;			// Allow group functions
+  fixed= 1;
   return 0;
 }
 
@@ -165,6 +166,7 @@ Item_sum_hybrid::fix_fields(THD *thd, TABLE_LIST *tables, Item **ref)
   null_value=1;
   fix_length_and_dec();
   thd->allow_sum_func=1;			// Allow group functions
+  fixed= 1;
   return 0;
 }
 
diff --git a/sql/item_sum.h b/sql/item_sum.h
index 3e67f1e3624..cc49ac8578f 100644
--- a/sql/item_sum.h
+++ b/sql/item_sum.h
@@ -384,6 +384,7 @@ public:
   const char *func_name() const { return udf.name(); }
   bool fix_fields(THD *thd, TABLE_LIST *tables, Item **ref)
   {
+    fixed= 1;
     return udf.fix_fields(thd,tables,this,this->arg_count,this->args);
   }
   enum Sumfunctype sum_func () const { return UDF_SUM_FUNC; }
diff --git a/sql/item_uniq.h b/sql/item_uniq.h
index f0d1d353cfb..2004be63de2 100644
--- a/sql/item_uniq.h
+++ b/sql/item_uniq.h
@@ -43,5 +43,9 @@ public:
   bool add() { return 0; }
   void reset_field() {}
   void update_field(int offset) {}
-  bool fix_fields(THD *thd, TABLE_LIST *tlist, Item **ref) { return 0;}
+  bool fix_fields(THD *thd, TABLE_LIST *tlist, Item **ref)
+  {
+    fixed= 1;
+    return 0;
+  }
 };
diff --git a/sql/share/czech/errmsg.txt b/sql/share/czech/errmsg.txt
index d43a433da06..14414326c06 100644
--- a/sql/share/czech/errmsg.txt
+++ b/sql/share/czech/errmsg.txt
@@ -254,3 +254,4 @@
 "Unknown prepared statement handler (%ld) given to %s",
 "Help database is corrupt or does not exist",
 "Cyclic reference on subqueries",
+"Reference '%-.64s' not supported (%s)",
diff --git a/sql/share/danish/errmsg.txt b/sql/share/danish/errmsg.txt
index 3a947bcbe38..8bc6cec83ee 100644
--- a/sql/share/danish/errmsg.txt
+++ b/sql/share/danish/errmsg.txt
@@ -248,3 +248,4 @@
 "Unknown prepared statement handler (%ld) given to %s",
 "Help database is corrupt or does not exist",
 "Cyclic reference on subqueries",
+"Reference '%-.64s' not supported (%s)",
diff --git a/sql/share/dutch/errmsg.txt b/sql/share/dutch/errmsg.txt
index 1cb81849be1..9b4865ffdf3 100644
--- a/sql/share/dutch/errmsg.txt
+++ b/sql/share/dutch/errmsg.txt
@@ -256,3 +256,4 @@
 "Unknown prepared statement handler (%ld) given to %s",
 "Help database is corrupt or does not exist",
 "Cyclic reference on subqueries",
+"Reference '%-.64s' not supported (%s)",
diff --git a/sql/share/english/errmsg.txt b/sql/share/english/errmsg.txt
index 6e96fdb393e..8057e218be6 100644
--- a/sql/share/english/errmsg.txt
+++ b/sql/share/english/errmsg.txt
@@ -245,3 +245,4 @@
 "Unknown prepared statement handler (%ld) given to %s",
 "Help database is corrupt or does not exist",
 "Cyclic reference on subqueries",
+"Reference '%-.64s' not supported (%s)",
diff --git a/sql/share/estonian/errmsg.txt b/sql/share/estonian/errmsg.txt
index 394c40c5778..206d9c69568 100644
--- a/sql/share/estonian/errmsg.txt
+++ b/sql/share/estonian/errmsg.txt
@@ -250,3 +250,4 @@
 "Unknown prepared statement handler (%ld) given to %s",
 "Help database is corrupt or does not exist",
 "Cyclic reference on subqueries",
+"Reference '%-.64s' not supported (%s)",
diff --git a/sql/share/french/errmsg.txt b/sql/share/french/errmsg.txt
index b18d3f8fb38..b675985c310 100644
--- a/sql/share/french/errmsg.txt
+++ b/sql/share/french/errmsg.txt
@@ -245,3 +245,4 @@
 "Unknown prepared statement handler (%ld) given to %s",
 "Help database is corrupt or does not exist",
 "Cyclic reference on subqueries",
+"Reference '%-.64s' not supported (%s)",
diff --git a/sql/share/german/errmsg.txt b/sql/share/german/errmsg.txt
index 49ea31dd05b..6fb265df3e4 100644
--- a/sql/share/german/errmsg.txt
+++ b/sql/share/german/errmsg.txt
@@ -248,3 +248,4 @@
 "Unknown prepared statement handler (%ld) given to %s",
 "Help database is corrupt or does not exist",
 "Cyclic reference on subqueries",
+"Reference '%-.64s' not supported (%s)",
diff --git a/sql/share/greek/errmsg.txt b/sql/share/greek/errmsg.txt
index b203c63949b..f72bf188140 100644
--- a/sql/share/greek/errmsg.txt
+++ b/sql/share/greek/errmsg.txt
@@ -245,3 +245,4 @@
 "Unknown prepared statement handler (%ld) given to %s",
 "Help database is corrupt or does not exist",
 "Cyclic reference on subqueries",
+"Reference '%-.64s' not supported (%s)",
diff --git a/sql/share/hungarian/errmsg.txt b/sql/share/hungarian/errmsg.txt
index 07081e689ad..7fb896a5632 100644
--- a/sql/share/hungarian/errmsg.txt
+++ b/sql/share/hungarian/errmsg.txt
@@ -247,3 +247,4 @@
 "Unknown prepared statement handler (%ld) given to %s",
 "Help database is corrupt or does not exist",
 "Cyclic reference on subqueries",
+"Reference '%-.64s' not supported (%s)",
diff --git a/sql/share/italian/errmsg.txt b/sql/share/italian/errmsg.txt
index 0a380e2b48f..93e4bee9b11 100644
--- a/sql/share/italian/errmsg.txt
+++ b/sql/share/italian/errmsg.txt
@@ -245,3 +245,4 @@
 "Unknown prepared statement handler (%ld) given to %s",
 "Help database is corrupt or does not exist",
 "Cyclic reference on subqueries",
+"Reference '%-.64s' not supported (%s)",
diff --git a/sql/share/japanese/errmsg.txt b/sql/share/japanese/errmsg.txt
index 2e0a083ca06..62d3c249e8d 100644
--- a/sql/share/japanese/errmsg.txt
+++ b/sql/share/japanese/errmsg.txt
@@ -247,3 +247,4 @@
 "Unknown prepared statement handler (%ld) given to %s",
 "Help database is corrupt or does not exist",
 "Cyclic reference on subqueries",
+"Reference '%-.64s' not supported (%s)",
diff --git a/sql/share/korean/errmsg.txt b/sql/share/korean/errmsg.txt
index 19fcf98e3c7..f74b159dd64 100644
--- a/sql/share/korean/errmsg.txt
+++ b/sql/share/korean/errmsg.txt
@@ -245,3 +245,4 @@
 "Unknown prepared statement handler (%ld) given to %s",
 "Help database is corrupt or does not exist",
 "Cyclic reference on subqueries",
+"Reference '%-.64s' not supported (%s)",
diff --git a/sql/share/norwegian-ny/errmsg.txt b/sql/share/norwegian-ny/errmsg.txt
index 810aaf38f74..82ab76821f7 100644
--- a/sql/share/norwegian-ny/errmsg.txt
+++ b/sql/share/norwegian-ny/errmsg.txt
@@ -247,3 +247,4 @@
 "Unknown prepared statement handler (%ld) given to %s",
 "Help database is corrupt or does not exist",
 "Cyclic reference on subqueries",
+"Reference '%-.64s' not supported (%s)",
diff --git a/sql/share/norwegian/errmsg.txt b/sql/share/norwegian/errmsg.txt
index a74a0a910b8..ab1a1833011 100644
--- a/sql/share/norwegian/errmsg.txt
+++ b/sql/share/norwegian/errmsg.txt
@@ -247,3 +247,4 @@
 "Unknown prepared statement handler (%ld) given to %s",
 "Help database is corrupt or does not exist",
 "Cyclic reference on subqueries",
+"Reference '%-.64s' not supported (%s)",
diff --git a/sql/share/polish/errmsg.txt b/sql/share/polish/errmsg.txt
index efde31ff4c9..111261bbe84 100644
--- a/sql/share/polish/errmsg.txt
+++ b/sql/share/polish/errmsg.txt
@@ -249,3 +249,4 @@
 "Unknown prepared statement handler (%ld) given to %s",
 "Help database is corrupt or does not exist",
 "Cyclic reference on subqueries",
+"Reference '%-.64s' not supported (%s)",
diff --git a/sql/share/portuguese/errmsg.txt b/sql/share/portuguese/errmsg.txt
index e90d5844b9b..03dab8ebe5c 100644
--- a/sql/share/portuguese/errmsg.txt
+++ b/sql/share/portuguese/errmsg.txt
@@ -245,3 +245,4 @@
 "Unknown prepared statement handler (%ld) given to %s",
 "Help database is corrupt or does not exist",
 "Cyclic reference on subqueries",
+"Reference '%-.64s' not supported (%s)",
diff --git a/sql/share/romanian/errmsg.txt b/sql/share/romanian/errmsg.txt
index 18f0bf7f79d..93e25ef637a 100644
--- a/sql/share/romanian/errmsg.txt
+++ b/sql/share/romanian/errmsg.txt
@@ -249,3 +249,4 @@
 "Unknown prepared statement handler (%ld) given to %s",
 "Help database is corrupt or does not exist",
 "Cyclic reference on subqueries",
+"Reference '%-.64s' not supported (%s)",
diff --git a/sql/share/russian/errmsg.txt b/sql/share/russian/errmsg.txt
index 790d738031c..4427104f2ef 100644
--- a/sql/share/russian/errmsg.txt
+++ b/sql/share/russian/errmsg.txt
@@ -248,3 +248,4 @@
 "Unknown prepared statement handler (%ld) given to %s",
 "Help database is corrupt or does not exist",
 "Циклическая ссылка на подзапрос",
+"Ссылка '%-.64s' не поддерживается (%s)",
diff --git a/sql/share/serbian/errmsg.txt b/sql/share/serbian/errmsg.txt
index e8186d38a5b..ad6bfe90129 100644
--- a/sql/share/serbian/errmsg.txt
+++ b/sql/share/serbian/errmsg.txt
@@ -241,3 +241,4 @@
 "Unknown prepared statement handler (%ld) given to %s",
 "Help database is corrupt or does not exist",
 "Cyclic reference on subqueries",
+"Reference '%-.64s' not supported (%s)",
diff --git a/sql/share/slovak/errmsg.txt b/sql/share/slovak/errmsg.txt
index 216d46fcd3a..55837225b60 100644
--- a/sql/share/slovak/errmsg.txt
+++ b/sql/share/slovak/errmsg.txt
@@ -253,3 +253,4 @@
 "Unknown prepared statement handler (%ld) given to %s",
 "Help database is corrupt or does not exist",
 "Cyclic reference on subqueries",
+"Reference '%-.64s' not supported (%s)",
diff --git a/sql/share/spanish/errmsg.txt b/sql/share/spanish/errmsg.txt
index 5076b1b6679..ed26f8b9e98 100644
--- a/sql/share/spanish/errmsg.txt
+++ b/sql/share/spanish/errmsg.txt
@@ -246,3 +246,4 @@
 "Unknown prepared statement handler (%ld) given to %s",
 "Help database is corrupt or does not exist",
 "Cyclic reference on subqueries",
+"Reference '%-.64s' not supported (%s)",
diff --git a/sql/share/swedish/errmsg.txt b/sql/share/swedish/errmsg.txt
index a3bb40fb4f5..dd836493ca8 100644
--- a/sql/share/swedish/errmsg.txt
+++ b/sql/share/swedish/errmsg.txt
@@ -245,3 +245,4 @@
 "Unknown prepared statement handler (%ld) given to %s",
 "Help database is corrupt or does not exist",
 "Cyclic reference on subqueries",
+"Reference '%-.64s' not supported (%s)",
diff --git a/sql/share/ukrainian/errmsg.txt b/sql/share/ukrainian/errmsg.txt
index 426c2a14e3b..801e8ff4112 100644
--- a/sql/share/ukrainian/errmsg.txt
+++ b/sql/share/ukrainian/errmsg.txt
@@ -250,3 +250,4 @@
 "Unknown prepared statement handler (%ld) given to %s",
 "Help database is corrupt or does not exist",
 "Циклiчне посилання на пiдзапит",
+"Посилання '%-.64s' не пiдтримуется (%s)",