Fixed BUG#14233: Crash after tampering with the mysql.proc table

  Added error checking for errors when attempting to use stored procedures
  after the mysql.proc table has been dropped, corrupted, or tampered with.
  Test cases were put in a separate file (sp-destruct.test).


mysql-test/t/sp.test:
  Added comment.
sql/share/errmsg.txt:
  New error message for corrupted mysql.proc table.
sql/sp.cc:
  Check and return error code when caching stored routines.
  In the case when no error message has been set, set one.
sql/sp.h:
  Return error code from stored routine cache function.
sql/sql_base.cc:
  Check for error from sp_cache_routines_* calls.
sql/sql_trigger.h:
  Updated friend declaration for sp_cache_routines*.
mysql-test/r/sp-destruct.result:
  New test file for destruction of the mysql.proc table.
mysql-test/t/sp-destruct.test:
  New result file for destruction of the mysql.proc table.

5 files changed, 95 insertions, 36 deletions

diff --git a/sql/share/errmsg.txt b/sql/share/errmsg.txt
index ccf11248a1f..141fd46d464 100644
--- a/sql/share/errmsg.txt
+++ b/sql/share/errmsg.txt
@@ -5422,3 +5422,5 @@ ER_NO_REFERENCED_ROW_2 23000
 	eng "Cannot add or update a child row: a foreign key constraint fails (%.192s)"
 ER_SP_BAD_VAR_SHADOW 42000
 	eng "Variable '%-.64s' must be quoted with `...`, or renamed"
+ER_SP_PROC_TABLE_CORRUPT
+	eng "The table mysql.proc is missing, corrupt, or contains bad data (internal code %d)"
diff --git a/sql/sp.cc b/sql/sp.cc
index 8386c5d58a2..6f08897b1af 100644
--- a/sql/sp.cc
+++ b/sql/sp.cc
@@ -1414,20 +1414,22 @@ static void sp_update_stmt_used_routines(THD *thd, LEX *lex, SQL_LIST *src)
       first_no_prelock - If true, don't add tables or cache routines used by
                          the body of the first routine (i.e. *start)
                          will be executed in non-prelocked mode.
+      tabs_changed     - Set to TRUE some tables were added, FALSE otherwise
   NOTE
     If some function is missing this won't be reported here.
     Instead this fact will be discovered during query execution.
 
   RETURN VALUE
-    TRUE  - some tables were added
-    FALSE - no tables were added.
+     0 - success
+    -x - failure (error code, like SP_PARSE_ERROR et al)
 */
 
-static bool
+static int
 sp_cache_routines_and_add_tables_aux(THD *thd, LEX *lex,
                                      Sroutine_hash_entry *start, 
-                                     bool first_no_prelock)
+                                     bool first_no_prelock, bool *tabs_changed)
 {
+  int ret= 0;
   bool result= FALSE;
   bool first= TRUE;
   DBUG_ENTER("sp_cache_routines_and_add_tables_aux");
@@ -1453,12 +1455,35 @@ sp_cache_routines_and_add_tables_aux(THD *thd, LEX *lex,
       name.m_name.str+= 1;
       name.m_name.length= name.m_qname.length - name.m_db.length - 1;
 
-      if (db_find_routine(thd, type, &name, &sp) == SP_OK)
+      switch ((ret= db_find_routine(thd, type, &name, &sp)))
       {
-        if (type == TYPE_ENUM_FUNCTION)
-          sp_cache_insert(&thd->sp_func_cache, sp);
-        else
-          sp_cache_insert(&thd->sp_proc_cache, sp);
+      case SP_OK:
+        {
+          if (type == TYPE_ENUM_FUNCTION)
+            sp_cache_insert(&thd->sp_func_cache, sp);
+          else
+            sp_cache_insert(&thd->sp_proc_cache, sp);
+        }
+        break;
+      case SP_KEY_NOT_FOUND:
+        ret= SP_OK;
+        break;
+      case SP_OPEN_TABLE_FAILED:
+        /*
+          Force it to attempt opening it again on subsequent calls;
+          otherwise we will get one error message the first time, and
+          then ER_SP_PROC_TABLE_CORRUPT (below) on subsequent tries.
+        */
+        mysql_proc_table_exists= 1;
+        /* Fall through */
+      default:
+        /*
+          In some cases no error has been set (e.g. get field failed,
+          when the proc table has been tampered with).
+         */
+        if (! thd->net.report_error)
+          my_error(ER_SP_PROC_TABLE_CORRUPT, MYF(0), ret);
+        break;
       }
       delete newlex;
       thd->lex= oldlex;
@@ -1473,7 +1498,9 @@ sp_cache_routines_and_add_tables_aux(THD *thd, LEX *lex,
     }
     first= FALSE;
   }
-  DBUG_RETURN(result);
+  if (tabs_changed)
+    *tabs_changed= result;
+  DBUG_RETURN(ret);
 }
 
 
@@ -1488,18 +1515,20 @@ sp_cache_routines_and_add_tables_aux(THD *thd, LEX *lex,
       lex              - LEX representing statement
       first_no_prelock - If true, don't add tables or cache routines used by
                          the body of the first routine (i.e. *start)
+      tabs_changed     - Set to TRUE some tables were added, FALSE otherwise
                          
   RETURN VALUE
-    TRUE  - some tables were added
-    FALSE - no tables were added.
+     0 - success
+    -x - failure (error code, like SP_PARSE_ERROR et al)
 */
 
-bool
-sp_cache_routines_and_add_tables(THD *thd, LEX *lex, bool first_no_prelock)
+int
+sp_cache_routines_and_add_tables(THD *thd, LEX *lex, bool first_no_prelock,
+                                 bool *tabs_changed)
 {
   return sp_cache_routines_and_add_tables_aux(thd, lex,
            (Sroutine_hash_entry *)lex->sroutines_list.first,
-           first_no_prelock);
+           first_no_prelock, tabs_changed);
 }
 
 
@@ -1513,16 +1542,21 @@ sp_cache_routines_and_add_tables(THD *thd, LEX *lex, bool first_no_prelock)
       thd     - thread context
       lex     - LEX representing statement
       aux_lex - LEX representing view
+                         
+  RETURN VALUE
+     0 - success
+    -x - failure (error code, like SP_PARSE_ERROR et al)
 */
 
-void
+int
 sp_cache_routines_and_add_tables_for_view(THD *thd, LEX *lex, LEX *aux_lex)
 {
   Sroutine_hash_entry **last_cached_routine_ptr=
                           (Sroutine_hash_entry **)lex->sroutines_list.next;
   sp_update_stmt_used_routines(thd, lex, &aux_lex->sroutines_list);
-  (void)sp_cache_routines_and_add_tables_aux(thd, lex, 
-                                             *last_cached_routine_ptr, FALSE);
+  return sp_cache_routines_and_add_tables_aux(thd, lex, 
+                                              *last_cached_routine_ptr, FALSE,
+                                              NULL);
 }
 
 
@@ -1536,12 +1570,18 @@ sp_cache_routines_and_add_tables_for_view(THD *thd, LEX *lex, LEX *aux_lex)
       thd      - thread context
       lex      - LEX respresenting statement
       triggers - triggers of the table
+
+  RETURN VALUE
+     0 - success
+    -x - failure (error code, like SP_PARSE_ERROR et al)
 */
 
-void
+int
 sp_cache_routines_and_add_tables_for_triggers(THD *thd, LEX *lex,
                                               Table_triggers_list *triggers)
 {
+  int ret= 0;
+
   if (add_used_routine(lex, thd->stmt_arena, &triggers->sroutines_key))
   {
     Sroutine_hash_entry **last_cached_routine_ptr=
@@ -1559,10 +1599,11 @@ sp_cache_routines_and_add_tables_for_triggers(THD *thd, LEX *lex,
         }
       }
     }
-    (void)sp_cache_routines_and_add_tables_aux(thd, lex,
-                                               *last_cached_routine_ptr, 
-                                               FALSE);
+    ret= sp_cache_routines_and_add_tables_aux(thd, lex,
+                                              *last_cached_routine_ptr, 
+                                              FALSE, NULL);
   }
+  return ret;
 }
 
 
diff --git a/sql/sp.h b/sql/sp.h
index 933e5793e4c..2332e8a0cbb 100644
--- a/sql/sp.h
+++ b/sql/sp.h
@@ -86,11 +86,11 @@ void sp_add_used_routine(LEX *lex, Query_arena *arena,
                          sp_name *rt, char rt_type);
 void sp_remove_not_own_routines(LEX *lex);
 void sp_update_sp_used_routines(HASH *dst, HASH *src);
-bool sp_cache_routines_and_add_tables(THD *thd, LEX *lex, 
-                                      bool first_no_prelock);
-void sp_cache_routines_and_add_tables_for_view(THD *thd, LEX *lex,
-                                               LEX *aux_lex);
-void sp_cache_routines_and_add_tables_for_triggers(THD *thd, LEX *lex,
+int sp_cache_routines_and_add_tables(THD *thd, LEX *lex, 
+                                     bool first_no_prelock, bool *tabs_changed);
+int sp_cache_routines_and_add_tables_for_view(THD *thd, LEX *lex,
+                                              LEX *aux_lex);
+int sp_cache_routines_and_add_tables_for_triggers(THD *thd, LEX *lex,
                                          Table_triggers_list *triggers);
 
 extern "C" byte* sp_sroutine_key(const byte *ptr, uint *plen, my_bool first);
diff --git a/sql/sql_base.cc b/sql/sql_base.cc
index 973fbca12f5..ed05dc6720a 100644
--- a/sql/sql_base.cc
+++ b/sql/sql_base.cc
@@ -1978,15 +1978,20 @@ int open_tables(THD *thd, TABLE_LIST **start, uint *counter, uint flags)
   if (!thd->prelocked_mode && !thd->lex->requires_prelocking() && 
       thd->lex->sroutines_list.elements)
   {
-    bool first_no_prelocking, need_prelocking;
+    bool first_no_prelocking, need_prelocking, tabs_changed;
     TABLE_LIST **save_query_tables_last= thd->lex->query_tables_last;
 
     DBUG_ASSERT(thd->lex->query_tables == *start);
     sp_get_prelocking_info(thd, &need_prelocking, &first_no_prelocking);
 
-    if ((sp_cache_routines_and_add_tables(thd, thd->lex,
-                                         first_no_prelocking) ||
-        *start) && need_prelocking)
+    if (sp_cache_routines_and_add_tables(thd, thd->lex,
+                                         first_no_prelocking,
+                                         &tabs_changed) < 0)
+    {
+      result= -1;               // Fatal error
+      goto err;
+    }
+    else if ((tabs_changed || *start) && need_prelocking)
     {
       query_tables_last_own= save_query_tables_last;
       *start= thd->lex->query_tables;
@@ -2110,9 +2115,13 @@ int open_tables(THD *thd, TABLE_LIST **start, uint *counter, uint flags)
           tables->lock_type >= TL_WRITE_ALLOW_WRITE)
       {
         if (!query_tables_last_own)
-            query_tables_last_own= thd->lex->query_tables_last;
-        sp_cache_routines_and_add_tables_for_triggers(thd, thd->lex,
-                                                      tables->table->triggers);
+          query_tables_last_own= thd->lex->query_tables_last;
+        if (sp_cache_routines_and_add_tables_for_triggers(thd, thd->lex,
+                                                   tables->table->triggers) < 0)
+        {
+          result= -1;               // Fatal error
+          goto err;
+        }
       }
       free_root(&new_frm_mem, MYF(MY_KEEP_PREALLOC));
     }
@@ -2133,9 +2142,16 @@ process_view_routines:
       /* We have at least one table in TL here. */
       if (!query_tables_last_own)
         query_tables_last_own= thd->lex->query_tables_last;
-      sp_cache_routines_and_add_tables_for_view(thd, thd->lex, tables->view);
+      if (sp_cache_routines_and_add_tables_for_view(thd, thd->lex,
+                                                    tables->view) < 0)
+      {
+        result= -1;               // Fatal error
+        goto err;
+      }
     }
   }
+
+ err:
   thd->proc_info=0;
   free_root(&new_frm_mem, MYF(0));              // Free pre-alloced block
 
diff --git a/sql/sql_trigger.h b/sql/sql_trigger.h
index c1d1f8d0e9e..f50624767be 100644
--- a/sql/sql_trigger.h
+++ b/sql/sql_trigger.h
@@ -101,7 +101,7 @@ public:
   void set_table(TABLE *new_table);
 
   friend class Item_trigger_field;
-  friend void sp_cache_routines_and_add_tables_for_triggers(THD *thd, LEX *lex,
+  friend int sp_cache_routines_and_add_tables_for_triggers(THD *thd, LEX *lex,
                 Table_triggers_list *triggers);
 
 private: