May 2010 - developers - lists.mariadb.org

[Maria-developers] Updated (by Serg): insert ignore ha_extra hint (114)
by worklog-noreply＠askmonty.org 10 May '10

10 May '10

----------------------------------------------------------------------- WORKLOG TASK -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- TASK...........: insert ignore ha_extra hint CREATION DATE..: Sun, 25 Apr 2010, 16:32 SUPERVISOR.....: Sergei IMPLEMENTOR....: COPIES TO......: CATEGORY.......: Server-BackLog TASK ID........: 114 (http://askmonty.org/worklog/?tid=114) VERSION........: Server-5.3 STATUS.........: Un-Assigned PRIORITY.......: 60 WORKED HOURS...: 0 ESTIMATE.......: 0 (hours remain) ORIG. ESTIMATE.: 0 PROGRESS NOTES: -=-=(Serg - Mon, 10 May 2010, 14:35)=-=- Category updated. --- /tmp/wklog.114.old.7124 2010-05-10 14:35:59.000000000 +0000 +++ /tmp/wklog.114.new.7124 2010-05-10 14:35:59.000000000 +0000 @@ -1 +1 @@ -Server-Sprint +Server-BackLog -=-=(Serg - Mon, 10 May 2010, 14:35)=-=- Version updated. --- /tmp/wklog.114.old.7124 2010-05-10 14:35:59.000000000 +0000 +++ /tmp/wklog.114.new.7124 2010-05-10 14:35:59.000000000 +0000 @@ -1 +1 @@ -Server-9.x +Server-5.3 DESCRIPTION: There is HA_EXTRA_WRITE_CAN_REPLACE hint that tells the engine that the following ::write_row() calls are part of the REPLACE statement, not INSERT. With this knowledge the engine can execute the replace internally, deleting the conflicting row in the ::write_row() method instead of returning an error. We need a similar HA_EXTRA_WRITE_CAN_IGNORE hint to allow engines to optimize INSERT IGNORE in a similar way. ESTIMATED WORK TIME ESTIMATED COMPLETION DATE ----------------------------------------------------------------------- WorkLog (v3.5.9)

1 0

[Maria-developers] Updated (by Serg): support many clustered keys per table (113)
by worklog-noreply＠askmonty.org 10 May '10

10 May '10

----------------------------------------------------------------------- WORKLOG TASK -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- TASK...........: support many clustered keys per table CREATION DATE..: Sun, 25 Apr 2010, 16:23 SUPERVISOR.....: Sergei IMPLEMENTOR....: COPIES TO......: CATEGORY.......: Server-BackLog TASK ID........: 113 (http://askmonty.org/worklog/?tid=113) VERSION........: Server-5.3 STATUS.........: Un-Assigned PRIORITY.......: 60 WORKED HOURS...: 0 ESTIMATE.......: 0 (hours remain) ORIG. ESTIMATE.: 0 PROGRESS NOTES: -=-=(Serg - Mon, 10 May 2010, 14:35)=-=- Category updated. --- /tmp/wklog.113.old.7118 2010-05-10 14:35:50.000000000 +0000 +++ /tmp/wklog.113.new.7118 2010-05-10 14:35:50.000000000 +0000 @@ -1 +1 @@ -Server-Sprint +Server-BackLog -=-=(Serg - Mon, 10 May 2010, 14:35)=-=- Version updated. --- /tmp/wklog.113.old.7105 2010-05-10 14:35:25.000000000 +0000 +++ /tmp/wklog.113.new.7105 2010-05-10 14:35:25.000000000 +0000 @@ -1 +1 @@ -Server-9.x +Server-5.3 DESCRIPTION: The server now assumes that there can be only one clustered key per table, and only primary key can be clustered. It's not true for certain storage engines, we need to remove this limitation ESTIMATED WORK TIME ESTIMATED COMPLETION DATE ----------------------------------------------------------------------- WorkLog (v3.5.9)

1 0

[Maria-developers] Updated (by Serg): support many clustered keys per table (113)
by worklog-noreply＠askmonty.org 10 May '10

10 May '10

----------------------------------------------------------------------- WORKLOG TASK -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- TASK...........: support many clustered keys per table CREATION DATE..: Sun, 25 Apr 2010, 16:23 SUPERVISOR.....: Sergei IMPLEMENTOR....: COPIES TO......: CATEGORY.......: Server-BackLog TASK ID........: 113 (http://askmonty.org/worklog/?tid=113) VERSION........: Server-5.3 STATUS.........: Un-Assigned PRIORITY.......: 60 WORKED HOURS...: 0 ESTIMATE.......: 0 (hours remain) ORIG. ESTIMATE.: 0 PROGRESS NOTES: -=-=(Serg - Mon, 10 May 2010, 14:35)=-=- Category updated. --- /tmp/wklog.113.old.7118 2010-05-10 14:35:50.000000000 +0000 +++ /tmp/wklog.113.new.7118 2010-05-10 14:35:50.000000000 +0000 @@ -1 +1 @@ -Server-Sprint +Server-BackLog -=-=(Serg - Mon, 10 May 2010, 14:35)=-=- Version updated. --- /tmp/wklog.113.old.7105 2010-05-10 14:35:25.000000000 +0000 +++ /tmp/wklog.113.new.7105 2010-05-10 14:35:25.000000000 +0000 @@ -1 +1 @@ -Server-9.x +Server-5.3 DESCRIPTION: The server now assumes that there can be only one clustered key per table, and only primary key can be clustered. It's not true for certain storage engines, we need to remove this limitation ESTIMATED WORK TIME ESTIMATED COMPLETION DATE ----------------------------------------------------------------------- WorkLog (v3.5.9)

1 0

[Maria-developers] Updated (by Serg): support many clustered keys per table (113)
by worklog-noreply＠askmonty.org 10 May '10

10 May '10

----------------------------------------------------------------------- WORKLOG TASK -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- TASK...........: support many clustered keys per table CREATION DATE..: Sun, 25 Apr 2010, 16:23 SUPERVISOR.....: Sergei IMPLEMENTOR....: COPIES TO......: CATEGORY.......: Server-Sprint TASK ID........: 113 (http://askmonty.org/worklog/?tid=113) VERSION........: Server-5.3 STATUS.........: Un-Assigned PRIORITY.......: 60 WORKED HOURS...: 0 ESTIMATE.......: 0 (hours remain) ORIG. ESTIMATE.: 0 PROGRESS NOTES: -=-=(Serg - Mon, 10 May 2010, 14:35)=-=- Version updated. --- /tmp/wklog.113.old.7105 2010-05-10 14:35:25.000000000 +0000 +++ /tmp/wklog.113.new.7105 2010-05-10 14:35:25.000000000 +0000 @@ -1 +1 @@ -Server-9.x +Server-5.3 DESCRIPTION: The server now assumes that there can be only one clustered key per table, and only primary key can be clustered. It's not true for certain storage engines, we need to remove this limitation ESTIMATED WORK TIME ESTIMATED COMPLETION DATE ----------------------------------------------------------------------- WorkLog (v3.5.9)

1 0

[Maria-developers] Updated (by Serg): support many clustered keys per table (113)
by worklog-noreply＠askmonty.org 10 May '10

10 May '10

----------------------------------------------------------------------- WORKLOG TASK -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- TASK...........: support many clustered keys per table CREATION DATE..: Sun, 25 Apr 2010, 16:23 SUPERVISOR.....: Sergei IMPLEMENTOR....: COPIES TO......: CATEGORY.......: Server-Sprint TASK ID........: 113 (http://askmonty.org/worklog/?tid=113) VERSION........: Server-5.3 STATUS.........: Un-Assigned PRIORITY.......: 60 WORKED HOURS...: 0 ESTIMATE.......: 0 (hours remain) ORIG. ESTIMATE.: 0 PROGRESS NOTES: -=-=(Serg - Mon, 10 May 2010, 14:35)=-=- Version updated. --- /tmp/wklog.113.old.7105 2010-05-10 14:35:25.000000000 +0000 +++ /tmp/wklog.113.new.7105 2010-05-10 14:35:25.000000000 +0000 @@ -1 +1 @@ -Server-9.x +Server-5.3 DESCRIPTION: The server now assumes that there can be only one clustered key per table, and only primary key can be clustered. It's not true for certain storage engines, we need to remove this limitation ESTIMATED WORK TIME ESTIMATED COMPLETION DATE ----------------------------------------------------------------------- WorkLog (v3.5.9)

1 0

[Maria-developers] bzr commit into MariaDB 5.1, with Maria 1.5:maria branch (knielsen:2860)
by knielsen＠knielsen-hq.org 10 May '10

10 May '10

#At lp:maria 2860 knielsen(a)knielsen-hq.org 2010-05-10 [merge] Automerge MariaDB 5.1.44b release. modified: mysql-test/r/grant.result mysql-test/t/grant.test sql/mysql_priv.h sql/partition_info.cc sql/sql_parse.cc sql/sql_table.cc sql/sql_yacc.yy sql/table.cc tests/mysql_client_test.c === modified file 'mysql-test/r/grant.result' --- a/mysql-test/r/grant.result 2010-01-29 10:42:31 +0000 +++ b/mysql-test/r/grant.result 2010-05-09 19:30:06 +0000 @@ -1413,3 +1413,19 @@ DROP USER 'user1'; DROP USER 'user1'@'localhost'; DROP USER 'user2'; DROP DATABASE db1; +CREATE DATABASE db1; +CREATE DATABASE db2; +GRANT SELECT ON db1.* to 'testbug'@localhost; +USE db2; +CREATE TABLE t1 (a INT); +USE test; +SELECT * FROM `../db2/tb2`; +ERROR 42S02: Table 'db1.../db2/tb2' doesn't exist +SELECT * FROM `../db2`.tb2; +ERROR 42000: SELECT command denied to user 'testbug'@'localhost' for table 'tb2' +SELECT * FROM `#mysql50#/../db2/tb2`; +ERROR 42S02: Table 'db1.#mysql50#/../db2/tb2' doesn't exist +DROP USER 'testbug'@localhost; +DROP TABLE db2.t1; +DROP DATABASE db1; +DROP DATABASE db2; === modified file 'mysql-test/t/grant.test' --- a/mysql-test/t/grant.test 2010-01-29 10:42:31 +0000 +++ b/mysql-test/t/grant.test 2010-05-09 19:30:06 +0000 @@ -1525,5 +1525,30 @@ DROP USER 'user1'@'localhost'; DROP USER 'user2'; DROP DATABASE db1; + +# +# Bug #53371: COM_FIELD_LIST can be abused to bypass table level grants. +# + +CREATE DATABASE db1; +CREATE DATABASE db2; +GRANT SELECT ON db1.* to 'testbug'@localhost; +USE db2; +CREATE TABLE t1 (a INT); +USE test; +connect (con1,localhost,testbug,,db1); +--error ER_NO_SUCH_TABLE +SELECT * FROM `../db2/tb2`; +--error ER_TABLEACCESS_DENIED_ERROR +SELECT * FROM `../db2`.tb2; +--error ER_NO_SUCH_TABLE +SELECT * FROM `#mysql50#/../db2/tb2`; +connection default; +disconnect con1; +DROP USER 'testbug'@localhost; +DROP TABLE db2.t1; +DROP DATABASE db1; +DROP DATABASE db2; + # Wait till we reached the initial number of concurrent sessions --source include/wait_until_count_sessions.inc === modified file 'sql/mysql_priv.h' --- a/sql/mysql_priv.h 2010-04-28 12:52:24 +0000 +++ b/sql/mysql_priv.h 2010-05-10 07:34:49 +0000 @@ -2289,7 +2289,7 @@ void update_create_info_from_table(HA_CR int rename_file_ext(const char * from,const char * to,const char * ext); bool check_db_name(LEX_STRING *db); bool check_column_name(const char *name); -bool check_table_name(const char *name, uint length); +bool check_table_name(const char *name, uint length, bool check_for_path_chars); char *get_field(MEM_ROOT *mem, Field *field); bool get_field(MEM_ROOT *mem, Field *field, class String *res); int wild_case_compare(CHARSET_INFO *cs, const char *str,const char *wildstr); === modified file 'sql/partition_info.cc' --- a/sql/partition_info.cc 2009-12-03 11:19:05 +0000 +++ b/sql/partition_info.cc 2010-05-09 19:30:06 +0000 @@ -972,7 +972,7 @@ bool partition_info::check_partition_inf part_elem->engine_type= default_engine_type; } if (check_table_name(part_elem->partition_name, - strlen(part_elem->partition_name))) + strlen(part_elem->partition_name), FALSE)) { my_error(ER_WRONG_PARTITION_NAME, MYF(0)); goto end; @@ -990,7 +990,7 @@ bool partition_info::check_partition_inf { sub_elem= sub_it++; if (check_table_name(sub_elem->partition_name, - strlen(sub_elem->partition_name))) + strlen(sub_elem->partition_name), FALSE)) { my_error(ER_WRONG_PARTITION_NAME, MYF(0)); goto end; === modified file 'sql/sql_parse.cc' --- a/sql/sql_parse.cc 2010-04-30 04:23:39 +0000 +++ b/sql/sql_parse.cc 2010-05-10 07:34:49 +0000 @@ -1334,6 +1334,11 @@ bool dispatch_command(enum enum_server_c system_charset_info, packet, db_length, thd->charset(), &dummy_errors); db_buff[db_length]= '\0'; + if (check_table_name(db_buff, db_length, FALSE)) + { + my_error(ER_WRONG_TABLE_NAME, MYF(0), db_buff); + break; + } table_list.alias= table_list.table_name= db_buff; if (!(fields= (char *) thd->memdup(wildcard, query_length + 1))) break; @@ -6298,7 +6303,7 @@ TABLE_LIST *st_select_lex::add_table_to_ DBUG_RETURN(0); // End of memory alias_str= alias ? alias->str : table->table.str; if (!test(table_options & TL_OPTION_ALIAS) && - check_table_name(table->table.str, table->table.length)) + check_table_name(table->table.str, table->table.length, FALSE)) { my_error(ER_WRONG_TABLE_NAME, MYF(0), table->table.str); DBUG_RETURN(0); === modified file 'sql/sql_table.cc' --- a/sql/sql_table.cc 2010-04-28 12:52:24 +0000 +++ b/sql/sql_table.cc 2010-05-10 07:34:49 +0000 @@ -435,7 +435,21 @@ uint tablename_to_filename(const char *f DBUG_PRINT("enter", ("from '%s'", from)); if ((length= check_n_cut_mysql50_prefix(from, to, to_length))) + { + /* + Check if the name supplied is a valid mysql 5.0 name and + make the name a zero length string if it's not. + Note that just returning zero length is not enough : + a lot of places don't check the return value and expect + a zero terminated string. + */ + if (check_table_name(to, length, TRUE)) + { + to[0]= 0; + length= 0; + } DBUG_RETURN(length); + } length= strconvert(system_charset_info, from, &my_charset_filename, to, to_length, &errors); if (check_if_legal_tablename(to) && === modified file 'sql/sql_yacc.yy' --- a/sql/sql_yacc.yy 2010-04-28 12:52:24 +0000 +++ b/sql/sql_yacc.yy 2010-05-10 07:34:49 +0000 @@ -6149,7 +6149,7 @@ alter_list_item: { MYSQL_YYABORT; } - if (check_table_name($3->table.str,$3->table.length) || + if (check_table_name($3->table.str,$3->table.length, FALSE) || ($3->db.str && check_db_name(&$3->db))) { my_error(ER_WRONG_TABLE_NAME, MYF(0), $3->table.str); === modified file 'sql/table.cc' --- a/sql/table.cc 2010-04-28 12:52:24 +0000 +++ b/sql/table.cc 2010-05-10 07:34:49 +0000 @@ -494,6 +494,19 @@ inline bool is_system_table_name(const c } +/** + Check if a string contains path elements +*/ + +static inline bool has_disabled_path_chars(const char *str) +{ + for (; *str; str++) + if (*str == FN_EXTCHAR || *str == '/' || *str == '\\' || *str == '~' || *str == '@') + return TRUE; + return FALSE; +} + + /* Read table definition from a binary / text based .frm file @@ -548,7 +561,8 @@ int open_table_def(THD *thd, TABLE_SHARE This kind of tables must have been opened only by the my_open() above. */ - if (strchr(share->table_name.str, '@') || + if (has_disabled_path_chars(share->table_name.str) || + has_disabled_path_chars(share->db.str) || !strncmp(share->db.str, MYSQL50_TABLE_NAME_PREFIX, MYSQL50_TABLE_NAME_PREFIX_LENGTH) || !strncmp(share->table_name.str, MYSQL50_TABLE_NAME_PREFIX, @@ -2718,7 +2732,6 @@ bool check_db_name(LEX_STRING *org_name) (name_length > NAME_CHAR_LEN)); /* purecov: inspected */ } - /* Allow anything as a table name, as long as it doesn't contain an ' ' at the end @@ -2726,7 +2739,7 @@ bool check_db_name(LEX_STRING *org_name) */ -bool check_table_name(const char *name, uint length) +bool check_table_name(const char *name, uint length, bool check_for_path_chars) { uint name_length= 0; // name length in symbols const char *end= name+length; @@ -2753,6 +2766,9 @@ bool check_table_name(const char *name, continue; } } + if (check_for_path_chars && + (*name == '/' || *name == '\\' || *name == '~' || *name == FN_EXTCHAR)) + return 1; #endif name++; name_length++; === modified file 'tests/mysql_client_test.c' --- a/tests/mysql_client_test.c 2010-01-11 13:15:28 +0000 +++ b/tests/mysql_client_test.c 2010-05-09 19:30:06 +0000 @@ -18092,6 +18092,50 @@ static void test_bug44495() DBUG_VOID_RETURN; } +static void test_bug53371() +{ + int rc; + MYSQL_RES *result; + + myheader("test_bug53371"); + + rc= mysql_query(mysql, "DROP TABLE IF EXISTS t1"); + myquery(rc); + rc= mysql_query(mysql, "DROP DATABASE IF EXISTS bug53371"); + myquery(rc); + rc= mysql_query(mysql, "DROP USER 'testbug'@localhost"); + + rc= mysql_query(mysql, "CREATE TABLE t1 (a INT)"); + myquery(rc); + rc= mysql_query(mysql, "CREATE DATABASE bug53371"); + myquery(rc); + rc= mysql_query(mysql, "GRANT SELECT ON bug53371.* to 'testbug'@localhost"); + myquery(rc); + + rc= mysql_change_user(mysql, "testbug", NULL, "bug53371"); + myquery(rc); + + rc= mysql_query(mysql, "SHOW COLUMNS FROM client_test_db.t1"); + DIE_UNLESS(rc); + DIE_UNLESS(mysql_errno(mysql) == 1142); + + result= mysql_list_fields(mysql, "../client_test_db/t1", NULL); + DIE_IF(result); + + result= mysql_list_fields(mysql, "#mysql50#/../client_test_db/t1", NULL); + DIE_IF(result); + + rc= mysql_change_user(mysql, opt_user, opt_password, current_db); + myquery(rc); + rc= mysql_query(mysql, "DROP TABLE t1"); + myquery(rc); + rc= mysql_query(mysql, "DROP DATABASE bug53371"); + myquery(rc); + rc= mysql_query(mysql, "DROP USER 'testbug'@localhost"); + myquery(rc); +} + + /* Read and parse arguments and MySQL options from my.cnf */ @@ -18401,6 +18445,7 @@ static struct my_tests_st my_tests[]= { { "test_bug30472", test_bug30472 }, { "test_bug20023", test_bug20023 }, { "test_bug45010", test_bug45010 }, + { "test_bug53371", test_bug53371 }, { "test_bug31418", test_bug31418 }, { "test_bug31669", test_bug31669 }, { "test_bug28386", test_bug28386 },

1 0

[Maria-developers] bzr commit into MariaDB 5.1, with Maria 1.5:maria branch (knielsen:2859)
by knielsen＠knielsen-hq.org 10 May '10

10 May '10

#At lp:maria 2859 knielsen(a)knielsen-hq.org 2010-05-10 Suppress a safemutex warning pending fix of MBug#578117. modified: mysql-test/suite/pbxt/r/pbxt_xa.result mysql-test/suite/pbxt/t/pbxt_xa.test === modified file 'mysql-test/suite/pbxt/r/pbxt_xa.result' --- a/mysql-test/suite/pbxt/r/pbxt_xa.result 2010-03-24 22:12:39 +0000 +++ b/mysql-test/suite/pbxt/r/pbxt_xa.result 2010-05-10 07:29:30 +0000 @@ -1,4 +1,5 @@ drop table if exists t1, t2; +CALL mtr.add_suppression("Found wrong usage of mutex 'LOCK_sync' and 'LOCK_active'"); CREATE TABLE t1 (a INT PRIMARY KEY) ENGINE=innodb; CREATE TABLE t2 (b INT PRIMARY KEY) ENGINE=pbxt; BEGIN; === modified file 'mysql-test/suite/pbxt/t/pbxt_xa.test' --- a/mysql-test/suite/pbxt/t/pbxt_xa.test 2010-03-24 22:12:39 +0000 +++ b/mysql-test/suite/pbxt/t/pbxt_xa.test 2010-05-10 07:29:30 +0000 @@ -4,6 +4,11 @@ drop table if exists t1, t2; --enable_warnings +# This warning is indication of a real bug, MBug#578117. +# But it is not a regression, so we suppress it to get a clean test run. +# This suppression must be removed as part of MBug#578117 fix. +CALL mtr.add_suppression("Found wrong usage of mutex 'LOCK_sync' and 'LOCK_active'"); + # # bug lp:544173, xa crash with two 2pc-capable storage engines without binlog #

1 0

[Maria-developers] bzr commit into MariaDB 5.1, with Maria 1.5:maria branch (knielsen:2834) Bug#53371
by knielsen＠knielsen-hq.org 09 May '10

09 May '10

#At lp:maria 2834 knielsen(a)knielsen-hq.org 2010-05-09 Cherry-pick fix for Bug#53371, security hole with bypassing grants using special path in db/table names. Bump MariaDB version for security fix release. modified: configure.in mysql-test/r/grant.result mysql-test/t/grant.test sql/mysql_priv.h sql/partition_info.cc sql/sql_parse.cc sql/sql_table.cc sql/sql_yacc.yy sql/table.cc tests/mysql_client_test.c === modified file 'configure.in' --- a/configure.in 2010-04-29 07:57:25 +0000 +++ b/configure.in 2010-05-09 19:30:06 +0000 @@ -7,7 +7,7 @@ AC_PREREQ(2.59) # Remember to also update version.c in ndb. # When changing major version number please also check switch statement # in mysqlbinlog::check_master_version(). -AC_INIT([MariaDB Server], [5.1.44a-MariaDB], [], [mysql]) +AC_INIT([MariaDB Server], [5.1.44b-MariaDB], [], [mysql]) AC_CONFIG_SRCDIR([sql/mysqld.cc]) AC_CANONICAL_SYSTEM # USTAR format gives us the possibility to store longer path names in === modified file 'mysql-test/r/grant.result' --- a/mysql-test/r/grant.result 2010-01-29 10:42:31 +0000 +++ b/mysql-test/r/grant.result 2010-05-09 19:30:06 +0000 @@ -1413,3 +1413,19 @@ DROP USER 'user1'; DROP USER 'user1'@'localhost'; DROP USER 'user2'; DROP DATABASE db1; +CREATE DATABASE db1; +CREATE DATABASE db2; +GRANT SELECT ON db1.* to 'testbug'@localhost; +USE db2; +CREATE TABLE t1 (a INT); +USE test; +SELECT * FROM `../db2/tb2`; +ERROR 42S02: Table 'db1.../db2/tb2' doesn't exist +SELECT * FROM `../db2`.tb2; +ERROR 42000: SELECT command denied to user 'testbug'@'localhost' for table 'tb2' +SELECT * FROM `#mysql50#/../db2/tb2`; +ERROR 42S02: Table 'db1.#mysql50#/../db2/tb2' doesn't exist +DROP USER 'testbug'@localhost; +DROP TABLE db2.t1; +DROP DATABASE db1; +DROP DATABASE db2; === modified file 'mysql-test/t/grant.test' --- a/mysql-test/t/grant.test 2010-01-29 10:42:31 +0000 +++ b/mysql-test/t/grant.test 2010-05-09 19:30:06 +0000 @@ -1525,5 +1525,30 @@ DROP USER 'user1'@'localhost'; DROP USER 'user2'; DROP DATABASE db1; + +# +# Bug #53371: COM_FIELD_LIST can be abused to bypass table level grants. +# + +CREATE DATABASE db1; +CREATE DATABASE db2; +GRANT SELECT ON db1.* to 'testbug'@localhost; +USE db2; +CREATE TABLE t1 (a INT); +USE test; +connect (con1,localhost,testbug,,db1); +--error ER_NO_SUCH_TABLE +SELECT * FROM `../db2/tb2`; +--error ER_TABLEACCESS_DENIED_ERROR +SELECT * FROM `../db2`.tb2; +--error ER_NO_SUCH_TABLE +SELECT * FROM `#mysql50#/../db2/tb2`; +connection default; +disconnect con1; +DROP USER 'testbug'@localhost; +DROP TABLE db2.t1; +DROP DATABASE db1; +DROP DATABASE db2; + # Wait till we reached the initial number of concurrent sessions --source include/wait_until_count_sessions.inc === modified file 'sql/mysql_priv.h' --- a/sql/mysql_priv.h 2010-03-04 08:03:07 +0000 +++ b/sql/mysql_priv.h 2010-05-09 19:30:06 +0000 @@ -2300,7 +2300,7 @@ void update_create_info_from_table(HA_CR int rename_file_ext(const char * from,const char * to,const char * ext); bool check_db_name(LEX_STRING *db); bool check_column_name(const char *name); -bool check_table_name(const char *name, uint length); +bool check_table_name(const char *name, uint length, bool check_for_path_chars); char *get_field(MEM_ROOT *mem, Field *field); bool get_field(MEM_ROOT *mem, Field *field, class String *res); int wild_case_compare(CHARSET_INFO *cs, const char *str,const char *wildstr); === modified file 'sql/partition_info.cc' --- a/sql/partition_info.cc 2009-12-03 11:19:05 +0000 +++ b/sql/partition_info.cc 2010-05-09 19:30:06 +0000 @@ -972,7 +972,7 @@ bool partition_info::check_partition_inf part_elem->engine_type= default_engine_type; } if (check_table_name(part_elem->partition_name, - strlen(part_elem->partition_name))) + strlen(part_elem->partition_name), FALSE)) { my_error(ER_WRONG_PARTITION_NAME, MYF(0)); goto end; @@ -990,7 +990,7 @@ bool partition_info::check_partition_inf { sub_elem= sub_it++; if (check_table_name(sub_elem->partition_name, - strlen(sub_elem->partition_name))) + strlen(sub_elem->partition_name), FALSE)) { my_error(ER_WRONG_PARTITION_NAME, MYF(0)); goto end; === modified file 'sql/sql_parse.cc' --- a/sql/sql_parse.cc 2010-04-29 07:57:25 +0000 +++ b/sql/sql_parse.cc 2010-05-09 19:30:06 +0000 @@ -1334,6 +1334,11 @@ bool dispatch_command(enum enum_server_c system_charset_info, packet, db_length, thd->charset(), &dummy_errors); db_buff[db_length]= '\0'; + if (check_table_name(db_buff, db_length, FALSE)) + { + my_error(ER_WRONG_TABLE_NAME, MYF(0), db_buff); + break; + } table_list.alias= table_list.table_name= db_buff; if (!(fields= (char *) thd->memdup(wildcard, query_length + 1))) break; @@ -6298,7 +6303,7 @@ TABLE_LIST *st_select_lex::add_table_to_ DBUG_RETURN(0); // End of memory alias_str= alias ? alias->str : table->table.str; if (!test(table_options & TL_OPTION_ALIAS) && - check_table_name(table->table.str, table->table.length)) + check_table_name(table->table.str, table->table.length, FALSE)) { my_error(ER_WRONG_TABLE_NAME, MYF(0), table->table.str); DBUG_RETURN(0); === modified file 'sql/sql_table.cc' --- a/sql/sql_table.cc 2010-03-04 08:03:07 +0000 +++ b/sql/sql_table.cc 2010-05-09 19:30:06 +0000 @@ -434,7 +434,21 @@ uint tablename_to_filename(const char *f DBUG_PRINT("enter", ("from '%s'", from)); if ((length= check_n_cut_mysql50_prefix(from, to, to_length))) + { + /* + Check if the name supplied is a valid mysql 5.0 name and + make the name a zero length string if it's not. + Note that just returning zero length is not enough : + a lot of places don't check the return value and expect + a zero terminated string. + */ + if (check_table_name(to, length, TRUE)) + { + to[0]= 0; + length= 0; + } DBUG_RETURN(length); + } length= strconvert(system_charset_info, from, &my_charset_filename, to, to_length, &errors); if (check_if_legal_tablename(to) && === modified file 'sql/sql_yacc.yy' --- a/sql/sql_yacc.yy 2010-03-04 08:03:07 +0000 +++ b/sql/sql_yacc.yy 2010-05-09 19:30:06 +0000 @@ -6149,7 +6149,7 @@ alter_list_item: { MYSQL_YYABORT; } - if (check_table_name($3->table.str,$3->table.length) || + if (check_table_name($3->table.str,$3->table.length, FALSE) || ($3->db.str && check_db_name(&$3->db))) { my_error(ER_WRONG_TABLE_NAME, MYF(0), $3->table.str); === modified file 'sql/table.cc' --- a/sql/table.cc 2010-03-10 10:32:14 +0000 +++ b/sql/table.cc 2010-05-09 19:30:06 +0000 @@ -494,6 +494,19 @@ inline bool is_system_table_name(const c } +/** + Check if a string contains path elements +*/ + +static inline bool has_disabled_path_chars(const char *str) +{ + for (; *str; str++) + if (*str == FN_EXTCHAR || *str == '/' || *str == '\\' || *str == '~' || *str == '@') + return TRUE; + return FALSE; +} + + /* Read table definition from a binary / text based .frm file @@ -548,7 +561,8 @@ int open_table_def(THD *thd, TABLE_SHARE This kind of tables must have been opened only by the my_open() above. */ - if (strchr(share->table_name.str, '@') || + if (has_disabled_path_chars(share->table_name.str) || + has_disabled_path_chars(share->db.str) || !strncmp(share->db.str, MYSQL50_TABLE_NAME_PREFIX, MYSQL50_TABLE_NAME_PREFIX_LENGTH) || !strncmp(share->table_name.str, MYSQL50_TABLE_NAME_PREFIX, @@ -2718,7 +2732,6 @@ bool check_db_name(LEX_STRING *org_name) (name_length > NAME_CHAR_LEN)); /* purecov: inspected */ } - /* Allow anything as a table name, as long as it doesn't contain an ' ' at the end @@ -2726,7 +2739,7 @@ bool check_db_name(LEX_STRING *org_name) */ -bool check_table_name(const char *name, uint length) +bool check_table_name(const char *name, uint length, bool check_for_path_chars) { uint name_length= 0; // name length in symbols const char *end= name+length; @@ -2753,6 +2766,9 @@ bool check_table_name(const char *name, continue; } } + if (check_for_path_chars && + (*name == '/' || *name == '\\' || *name == '~' || *name == FN_EXTCHAR)) + return 1; #endif name++; name_length++; === modified file 'tests/mysql_client_test.c' --- a/tests/mysql_client_test.c 2010-01-11 13:15:28 +0000 +++ b/tests/mysql_client_test.c 2010-05-09 19:30:06 +0000 @@ -18092,6 +18092,50 @@ static void test_bug44495() DBUG_VOID_RETURN; } +static void test_bug53371() +{ + int rc; + MYSQL_RES *result; + + myheader("test_bug53371"); + + rc= mysql_query(mysql, "DROP TABLE IF EXISTS t1"); + myquery(rc); + rc= mysql_query(mysql, "DROP DATABASE IF EXISTS bug53371"); + myquery(rc); + rc= mysql_query(mysql, "DROP USER 'testbug'@localhost"); + + rc= mysql_query(mysql, "CREATE TABLE t1 (a INT)"); + myquery(rc); + rc= mysql_query(mysql, "CREATE DATABASE bug53371"); + myquery(rc); + rc= mysql_query(mysql, "GRANT SELECT ON bug53371.* to 'testbug'@localhost"); + myquery(rc); + + rc= mysql_change_user(mysql, "testbug", NULL, "bug53371"); + myquery(rc); + + rc= mysql_query(mysql, "SHOW COLUMNS FROM client_test_db.t1"); + DIE_UNLESS(rc); + DIE_UNLESS(mysql_errno(mysql) == 1142); + + result= mysql_list_fields(mysql, "../client_test_db/t1", NULL); + DIE_IF(result); + + result= mysql_list_fields(mysql, "#mysql50#/../client_test_db/t1", NULL); + DIE_IF(result); + + rc= mysql_change_user(mysql, opt_user, opt_password, current_db); + myquery(rc); + rc= mysql_query(mysql, "DROP TABLE t1"); + myquery(rc); + rc= mysql_query(mysql, "DROP DATABASE bug53371"); + myquery(rc); + rc= mysql_query(mysql, "DROP USER 'testbug'@localhost"); + myquery(rc); +} + + /* Read and parse arguments and MySQL options from my.cnf */ @@ -18401,6 +18445,7 @@ static struct my_tests_st my_tests[]= { { "test_bug30472", test_bug30472 }, { "test_bug20023", test_bug20023 }, { "test_bug45010", test_bug45010 }, + { "test_bug53371", test_bug53371 }, { "test_bug31418", test_bug31418 }, { "test_bug31669", test_bug31669 }, { "test_bug28386", test_bug28386 },

1 0

[Maria-developers] BuildBot Outage
by Adam M. Dutko 08 May '10

08 May '10

The following buildbots will be unavailable until May 12th: adutko-centos5-amd64 adutko-ultrasparc3 mariadb-brs Sorry for the inconvenience. -Adam

1 0

Re: [Maria-developers] [Drizzle-discuss] Learning Storage Engine API
by Venu Kalyan 08 May '10

08 May '10

Hi You should check this link, as it has everything on storage engine API: http://forge.mysql.com/wiki/MySQL_Internals_Custom_Engine Also; you should check the example storage engine source code (storage/example) for bootstrapping, so that you can get your dummy storage engine ready in few minutes. Once you start, it will be real fun and easy to start though... Have fun Venu On Mon, Apr 19, 2010 at 1:35 PM, Igor K <igor175(a)gmail.com> wrote: > Dear all, > > I am new to the community and would like to ask a question: > > What is the best approach, in your opinion, to start learning storage > engine API? So that one can write a dummy storage engine in no time. > > Advices from the experts as well as various experiences from life are > welcomed. > > Igor Kozachenko > University of California, Berkeley > > _______________________________________________ > Mailing list: https://launchpad.net/~drizzle-discuss<https://launchpad.net/%7Edrizzle-discuss> > Post to : drizzle-discuss(a)lists.launchpad.net > Unsubscribe : https://launchpad.net/~drizzle-discuss<https://launchpad.net/%7Edrizzle-discuss> > More help : https://help.launchpad.net/ListHelp >

4 4