------------------------------------------------------------
revno: 2862
committer: Sunanda Menon <sunanda.menon@sun.com
branch nick: mysql-5.0.91-release
timestamp: Wed 2010-05-05 15:33:46 +0200
message:
  ------------------------------------------------------------
  revno: 2861
  committer: Georgi Kodinov <joro@sun.com>
  branch nick: B53371-5.0-bugteam
  timestamp: Mon 2010-05-03 18:16:51 +0300
  message:
    Bug #53371: COM_FIELD_LIST can be abused to bypass table level grants.
    
    The server was not checking the supplied to COM_FIELD_LIST table name
    for validity and compliance to acceptable table names standards.
    Fixed by checking the table name for compliance similar to how it's 
    normally checked by the parser and returning an error message if 
    it's not compliant.
------------------------------------------------------------
revno: 2861
tags: clone-5.0.91-build
committer: Georgi Kodinov <joro@sun.com>
branch nick: merge-5.0-bugteam
timestamp: Sat 2010-05-01 16:46:04 +0300
message:
  tree name change
------------------------------------------------------------
revno: 2860
committer: Davi Arnaut <Davi.Arnaut@Sun.COM>
branch nick: 50974-5.0
timestamp: Thu 2010-04-29 10:28:16 -0300
message:
  Bug#50974: Server keeps receiving big (> max_allowed_packet) packets indefinitely.
  
  The server could be tricked to read packets indefinitely if it
  received a packet larger than the maximum size of one packet.
  This problem is aggravated by the fact that it can be triggered
  before authentication.
  
  The solution is to no skip big packets for non-authenticated
  sessions. If a big packet is sent before a session is authen-
  ticated, a error is returned and the connection is closed.
------------------------------------------------------------
revno: 2859
committer: Ramil Kalimullin <ramil@mysql.com>
branch nick: b53237-5.0-bugteam
timestamp: Thu 2010-04-29 08:42:32 +0400
message:
  Fix for bug #53237: mysql_list_fields/COM_FIELD_LIST stack smashing
  
  Problem: "COM_FIELD_LIST is an old command of the MySQL server, before there was real move to only
  SQL. Seems that the data sent to COM_FIELD_LIST( mysql_list_fields() function) is not
  checked for sanity. By sending long data for the table a buffer is overflown, which can
  be used deliberately to include code that harms".
  
  Fix: check incoming data length.
------------------------------------------------------------
revno: 2858
committer: Alexey Kopytov <Alexey.Kopytov@Sun.com>
branch nick: mysql-5.0-bugteam
timestamp: Tue 2010-04-27 00:06:00 +0400
message:
  Backport of the fix for bug #50335 to 5.0.
  
  The problem was in an incorrect debug assertion. The expression
  used in the failing assertion states that when finding
  references matching ORDER BY expressions, there can be only one
  reference to a single table. But that does not make any sense,
  all test cases for this bug are valid examples with multiple
  identical WHERE expressions referencing the same table which
  are also present in the ORDER BY list.
  
  Fixed by removing the failing assertion. We also have to take
  care of the 'found' counter so that we count multiple
  references only once. We rely on this fact later in
  eq_ref_table().
------------------------------------------------------------
revno: 2857
committer: Georgi Kodinov <joro@sun.com>
branch nick: merge-5.0-bugteam
timestamp: Tue 2010-04-06 10:58:45 +0300
message:
  changed the version back
------------------------------------------------------------
revno: 2856
committer: Georgi Kodinov <joro@sun.com>
branch nick: merge-5.0-bugteam
timestamp: Tue 2010-04-06 10:51:52 +0300
message:
  merge
    ------------------------------------------------------------
    revno: 2846.2.1
    committer: Georgi Kodinov <joro@sun.com>
    branch nick: merge-5.0-bugteam
    timestamp: Mon 2010-03-01 10:35:14 +0200
    message:
      tree version change
------------------------------------------------------------
revno: 2855
committer: Georgi Kodinov <joro@sun.com>
branch nick: B51893-take2-5.0-bugteam
timestamp: Tue 2010-03-30 15:03:50 +0300
message:
  Bug #51893: crash with certain characters given to load_file 
   function on windows
                 
  When making sure that the directory path ends up with a 
  slash/backslash we need to check for the correct length of 
  the buffer and trim at the appropriate location so we don't
  write past the end of the buffer.
------------------------------------------------------------
revno: 2854
committer: Sergey Glukhov <Sergey.Glukhov@sun.com>
branch nick: mysql-5.0-bugteam
timestamp: Fri 2010-03-26 11:44:24 +0400
message:
  Bug#52177 crash with explain, row comparison, join, text field
  The crash is the result of an attempt made by JOIN::optimize to evaluate
  the WHERE condition when no records have been actually read.
  The fix is to remove erroneous 'outer_join' variable check.
------------------------------------------------------------
revno: 2853
committer: Sergey Glukhov <Sergey.Glukhov@sun.com>
branch nick: mysql-5.0-bugteam
timestamp: Wed 2010-03-24 14:37:28 +0400
message:
  Bug#48483 crash in get_best_combination()
  The crash happens because greedy_serach
  can not determine best plan due to
  wrong inner table dependences. These
  dependences affects join table sorting
  which performs before greedy_search starting.
  In our case table which has real 'no dependences'
  should be put on top of the list but it does not
  happen as inner tables have no dependences as well.
  The fix is to exclude RAND_TABLE_BIT mask from
  condition which checks if table dependences
  should be updated.
------------------------------------------------------------
revno: 2852
committer: Sergey Vojtovich <svoj@sun.com>
branch nick: mysql-5.0-bugteam-push
timestamp: Wed 2010-03-10 19:28:49 +0400
message:
  An addition to fix for
  
  BUG#51342 - more xid crashing
  
  Restore autocommit variable by supplying explicit value.
------------------------------------------------------------
revno: 2851
committer: Sergey Vojtovich <svoj@sun.com>
branch nick: mysql-5.0-bugteam-push
timestamp: Wed 2010-03-10 15:07:35 +0400
message:
  Merge fix for BUG51342 to 5.0-bugteam.
    ------------------------------------------------------------
    revno: 2846.1.1
    committer: Sergey Vojtovich <svoj@sun.com>
    branch nick: mysql-5.0-bugteam-bug51342
    timestamp: Wed 2010-03-10 15:04:32 +0400
    message:
      BUG#51342 - more xid crashing
      
      SET autocommit=1 while XA transaction is active may
      cause various side effects, including memory corruption
      and server crash.
      
      The problem is that SET autocommit=1 and further queries
      attempt to commit local transaction, whereas XA transaction
      is still active.
      
      As local and XA transactions are mutually exclusive, this
      patch forbids enabling autocommit mode while XA transaction
      is active.
------------------------------------------------------------
revno: 2850
committer: Georgi Kodinov <joro@sun.com>
branch nick: fix-5.0-bugteam
timestamp: Wed 2010-03-10 12:11:39 +0200
message:
  merged the test disablement because of bug 51357 to 5.0-bugteam
------------------------------------------------------------
revno: 2849
committer: Georgi Kodinov <joro@sun.com>
branch nick: B51357-5.0-bugteam
timestamp: Mon 2010-03-08 12:39:57 +0200
message:
  Backport of the fix for bug #51357 to 5.0-bugteam.:
  
  Spatial indexes were not checking for out-of-record condition in
  the handler next command when the previous command didn't found
  rows.
  
  Fixed by making the rtree index to check for end of rows condition
  before re-using the key from the previous search.
  
  Fixed another crash if the tree has changed since the last search.
  Added a test case for the other error.
------------------------------------------------------------
revno: 2848
committer: Tatiana A. Nurnberg <azundris@mysql.com>
branch nick: 50-1
timestamp: Thu 2010-03-04 12:39:29 +0000
message:
  auto-merge
    ------------------------------------------------------------
    revno: 2840.3.1
    committer: Tatiana A. Nurnberg <azundris@mysql.com>
    branch nick: 50-48295_
    timestamp: Tue 2010-03-02 18:00:53 +0000
    message:
      Bug#48295: explain extended crash with subquery and ONLY_FULL_GROUP_BY sql
      
      If an outer query is broken, a subquery might not even get set up.
      EXPLAIN EXTENDED did not expect this and merrily tried to de-ref all
      of the half-setup info.
      
      We now catch this case and print as much as we have, as it doesn't cost us
      anything (doesn't make regular execution slower).
      
      backport from 5.1
------------------------------------------------------------
revno: 2847
committer: Tatiana A. Nurnberg <azundris@mysql.com>
branch nick: 50-1
timestamp: Thu 2010-03-04 12:23:05 +0000
message:
  auto-merge
    ------------------------------------------------------------
    revno: 2843.1.2
    committer: Tatiana A. Nurnberg <azundris@mysql.com>
    branch nick: 50-49487__
    timestamp: Tue 2010-03-02 16:18:16 +0000
    message:
      auto-merge
    ------------------------------------------------------------
    revno: 2843.1.1
    committer: Tatiana A. Nurnberg <azundris@mysql.com>
    branch nick: 50-49487__
    timestamp: Fri 2010-02-19 15:16:43 +0000
    message:
      Bug#49487: crash with explain extended and group_concat in a derived table
      
      When EXPLAIN EXTENDED tries to print column names, it checks whether the
      referenced table is CONST (in which case, the column's value rather than
      its name will be printed). If no proper table is reference (i.e. because
      a derived table was used that has since gone out of scope), this will fail
      spectacularly.
      
      This ports an equivalent of the fix for Bug 43354.
------------------------------------------------------------
revno: 2846
committer: Georgi Kodinov <joro@sun.com>
branch nick: merge-5.0-bugteam
timestamp: Fri 2010-02-26 15:10:25 +0200
message:
  merge
    ------------------------------------------------------------
    revno: 2840.1.9
    author: sunanda.menon@sun.com
    committer: MySQL Build Team <build@mysql.com>
    branch nick: mysql-5.0
    timestamp: Sat 2010-02-20 18:08:35 +0100
    message:
      Null-merge from mysql-5.0.87sp1-release
        ------------------------------------------------------------
        revno: 2812.2.19
        tags: mysql-5.0.87sp1
        committer: MySQL Build Team <build@mysql.com>
        branch nick: mysql-5.0.87sp1-release
        timestamp: Wed 2010-02-03 16:43:18 +0100
        message:
          Backport into build-201002030816-5.0.87sp1
          
          > ------------------------------------------------------------
          > revno: 2840 [merge]
          > revision-id: ramil@mysql.com-20100113101142-pda4phrsyh1rjp85
          > parent: joerg@mysql.com-20100112114118-zfpofgcu0j49j839
          > parent: ramil@mysql.com-20100113052045-een35iazzk8023w2
          > committer: Ramil Kalimullin <ramil@mysql.com>
          > branch nick: mysql-5.0-bugteam
          > timestamp: Wed 2010-01-13 14:11:42 +0400
          > message:
          >   Auto-merge.
          > ------------------------------------------------------------
          > Use --include-merges or -n0 to see merged revisions.
