From 6e771358cee7d56a1b89b4b959112864719e1174 Mon Sep 17 00:00:00 2001
From: "kroki/tomash@moonlight.home" <>
Date: Thu, 18 Jan 2007 12:48:17 +0300
Subject: [PATCH 1/7] Bug#24404: strange bug with view+permission+prepared
 statement.

The problem was that if a prepared statement accessed a view, the
access to the tables listed in the query after that view was done in
the security context of the view.

The bug was in the assigning of the security context to the tables
belonging to a view: we traversed the list of all query tables
instead.  It didn't show up in the normal (non-prepared) statements
because of the different order of the steps of checking privileges
and descending into a view for normal and prepared statements.

The solution is to traverse the list and stop once the last table
belonging to the view was processed.
---
 mysql-test/r/view_grant.result | 43 ++++++++++++++++++++
 mysql-test/t/view_grant.test   | 72 +++++++++++++++++++++++++++++++++-
 sql/sql_view.cc                | 10 +++--
 3 files changed, 121 insertions(+), 4 deletions(-)

diff --git a/mysql-test/r/view_grant.result b/mysql-test/r/view_grant.result
index 35e7afc0a7b..bdb362a5112 100644
--- a/mysql-test/r/view_grant.result
+++ b/mysql-test/r/view_grant.result
@@ -712,3 +712,46 @@ DROP FUNCTION f1;
 DROP VIEW v2;
 DROP VIEW v1;
 DROP USER mysqltest_u1@localhost;
+DROP DATABASE IF EXISTS mysqltest_db1;
+DROP DATABASE IF EXISTS mysqltest_db2;
+DROP USER mysqltest_u1;
+DROP USER mysqltest_u2;
+CREATE USER mysqltest_u1@localhost;
+CREATE USER mysqltest_u2@localhost;
+CREATE DATABASE mysqltest_db1;
+CREATE DATABASE mysqltest_db2;
+GRANT ALL ON mysqltest_db1.* TO mysqltest_u1@localhost WITH GRANT OPTION;
+GRANT ALL ON mysqltest_db2.* TO mysqltest_u2@localhost;
+CREATE TABLE t1 (i INT);
+INSERT INTO t1 VALUES (1);
+CREATE VIEW v1 AS SELECT i FROM t1 WHERE 1 IN (SELECT * FROM t1);
+CREATE TABLE t2 (s CHAR(7));
+INSERT INTO t2 VALUES ('public');
+GRANT SELECT ON v1 TO mysqltest_u2@localhost;
+GRANT SELECT ON t2 TO mysqltest_u2@localhost;
+SELECT * FROM mysqltest_db1.v1, mysqltest_db1.t2;
+i	s
+1	public
+PREPARE stmt1 FROM "SELECT * FROM mysqltest_db1.t2";
+EXECUTE stmt1;
+s
+public
+PREPARE stmt2 FROM "SELECT * FROM mysqltest_db1.v1, mysqltest_db1.t2";
+EXECUTE stmt2;
+i	s
+1	public
+REVOKE SELECT ON t2 FROM mysqltest_u2@localhost;
+UPDATE t2 SET s = 'private' WHERE s = 'public';
+SELECT * FROM mysqltest_db1.v1, mysqltest_db1.t2;
+ERROR 42000: SELECT command denied to user 'mysqltest_u2'@'localhost' for table 't2'
+EXECUTE stmt1;
+ERROR 42000: SELECT command denied to user 'mysqltest_u2'@'localhost' for table 't2'
+EXECUTE stmt2;
+ERROR 42000: SELECT command denied to user 'mysqltest_u2'@'localhost' for table 't2'
+REVOKE ALL ON mysqltest_db1.* FROM mysqltest_u1@localhost;
+REVOKE ALL ON mysqltest_db2.* FROM mysqltest_u2@localhost;
+DROP DATABASE mysqltest_db1;
+DROP DATABASE mysqltest_db2;
+DROP USER mysqltest_u1@localhost;
+DROP USER mysqltest_u2@localhost;
+End of 5.0 tests.
diff --git a/mysql-test/t/view_grant.test b/mysql-test/t/view_grant.test
index 4a3a29e3afe..ea6dbeb0a4b 100644
--- a/mysql-test/t/view_grant.test
+++ b/mysql-test/t/view_grant.test
@@ -927,4 +927,74 @@ DROP VIEW v2;
 DROP VIEW v1;
 DROP USER mysqltest_u1@localhost;
 
-# End of 5.0 tests.
+
+#
+# BUG#24404: strange bug with view+permission+prepared statement
+#
+--disable_warnings
+DROP DATABASE IF EXISTS mysqltest_db1;
+DROP DATABASE IF EXISTS mysqltest_db2;
+--enable_warnings
+--error 0,ER_CANNOT_USER
+DROP USER mysqltest_u1;
+--error 0,ER_CANNOT_USER
+DROP USER mysqltest_u2;
+
+CREATE USER mysqltest_u1@localhost;
+CREATE USER mysqltest_u2@localhost;
+
+CREATE DATABASE mysqltest_db1;
+CREATE DATABASE mysqltest_db2;
+
+GRANT ALL ON mysqltest_db1.* TO mysqltest_u1@localhost WITH GRANT OPTION;
+GRANT ALL ON mysqltest_db2.* TO mysqltest_u2@localhost;
+
+connect (conn1, localhost, mysqltest_u1, , mysqltest_db1);
+
+CREATE TABLE t1 (i INT);
+INSERT INTO t1 VALUES (1);
+
+# Use view with subquery for better coverage.
+CREATE VIEW v1 AS SELECT i FROM t1 WHERE 1 IN (SELECT * FROM t1);
+
+CREATE TABLE t2 (s CHAR(7));
+INSERT INTO t2 VALUES ('public');
+
+GRANT SELECT ON v1 TO mysqltest_u2@localhost;
+GRANT SELECT ON t2 TO mysqltest_u2@localhost;
+
+connect (conn2, localhost, mysqltest_u2, , mysqltest_db2);
+
+SELECT * FROM mysqltest_db1.v1, mysqltest_db1.t2;
+PREPARE stmt1 FROM "SELECT * FROM mysqltest_db1.t2";
+EXECUTE stmt1;
+PREPARE stmt2 FROM "SELECT * FROM mysqltest_db1.v1, mysqltest_db1.t2";
+EXECUTE stmt2;
+
+connection conn1;
+# Make table 't2' private.
+REVOKE SELECT ON t2 FROM mysqltest_u2@localhost;
+UPDATE t2 SET s = 'private' WHERE s = 'public';
+
+connection conn2;
+--error ER_TABLEACCESS_DENIED_ERROR
+SELECT * FROM mysqltest_db1.v1, mysqltest_db1.t2;
+--error ER_TABLEACCESS_DENIED_ERROR
+EXECUTE stmt1;
+# Original bug was here: the statement didn't fail.
+--error ER_TABLEACCESS_DENIED_ERROR
+EXECUTE stmt2;
+
+# Cleanup.
+disconnect conn2;
+disconnect conn1;
+connection default;
+REVOKE ALL ON mysqltest_db1.* FROM mysqltest_u1@localhost;
+REVOKE ALL ON mysqltest_db2.* FROM mysqltest_u2@localhost;
+DROP DATABASE mysqltest_db1;
+DROP DATABASE mysqltest_db2;
+DROP USER mysqltest_u1@localhost;
+DROP USER mysqltest_u2@localhost;
+
+
+--echo End of 5.0 tests.
diff --git a/sql/sql_view.cc b/sql/sql_view.cc
index c0cdaf59712..8cb7ea9cd81 100644
--- a/sql/sql_view.cc
+++ b/sql/sql_view.cc
@@ -1136,13 +1136,17 @@ bool mysql_make_view(THD *thd, File_parser *parser, TABLE_LIST *table,
       /*
         Prepare a security context to check underlying objects of the view
       */
-      Security_context *save_security_ctx= thd->security_ctx;
       if (!(table->view_sctx= (Security_context *)
             thd->stmt_arena->alloc(sizeof(Security_context))))
         goto err;
       /* Assign the context to the tables referenced in the view */
-      for (tbl= view_tables; tbl; tbl= tbl->next_global)
-        tbl->security_ctx= table->view_sctx;
+      if (view_tables)
+      {
+        DBUG_ASSERT(view_tables_tail);
+        for (tbl= view_tables; tbl != view_tables_tail->next_global;
+             tbl= tbl->next_global)
+          tbl->security_ctx= table->view_sctx;
+      }
       /* assign security context to SELECT name resolution contexts of view */
       for(SELECT_LEX *sl= lex->all_selects_list;
           sl;

From 436e1f591a37826bfd3e9ced6e393d885d997e7c Mon Sep 17 00:00:00 2001
From: "malff/marcsql@weblab.(none)" <>
Date: Thu, 18 Jan 2007 16:53:49 -0700
Subject: [PATCH 2/7] Bug#24562 (ALTER TABLE ... ORDER BY ... with complex
 expression asserts) WL#3681 (ALTER TABLE ORDER BY)

Before this fix, the ALTER TABLE statement implemented an ORDER BY option
with the following characteristics :

1) The order by clause accepts a list of criteria, with optional ASC or
DESC keywords

2) Each criteria can be a general expression, involving operators,
native functions, stored functions, user defined functions, subselects ...

With this fix :

1) has been left unchanged, since it's a de-facto existing feature,
that was already present in the code base and partially covered in the test
suite. Code coverage for ASC and DESC was missing and has been improved.

2) has been changed to limit the kind of criteria that are permissible:
now only a column name is valid.
---
 mysql-test/r/alter_table.result | 113 ++++++++++++++++++++++++++++++++
 mysql-test/t/alter_table.test   |  66 +++++++++++++++++++
 sql/sql_yacc.yy                 |  25 ++++++-
 3 files changed, 203 insertions(+), 1 deletion(-)

diff --git a/mysql-test/r/alter_table.result b/mysql-test/r/alter_table.result
index 60830cd9c45..da5cf688325 100644
--- a/mysql-test/r/alter_table.result
+++ b/mysql-test/r/alter_table.result
@@ -690,3 +690,116 @@ SHOW INDEX FROM bug24219_2;
 Table	Non_unique	Key_name	Seq_in_index	Column_name	Collation	Cardinality	Sub_part	Packed	Null	Index_type	Comment
 bug24219_2	1	a	1	a	A	NULL	NULL	NULL	YES	BTREE	disabled
 DROP TABLE bug24219_2;
+drop table if exists table_24562;
+create table table_24562(
+section int,
+subsection int,
+title varchar(50));
+insert into table_24562 values
+(1, 0, "Introduction"),
+(1, 1, "Authors"),
+(1, 2, "Acknowledgements"),
+(2, 0, "Basics"),
+(2, 1, "Syntax"),
+(2, 2, "Client"),
+(2, 3, "Server"),
+(3, 0, "Intermediate"),
+(3, 1, "Complex queries"),
+(3, 2, "Stored Procedures"),
+(3, 3, "Stored Functions"),
+(4, 0, "Advanced"),
+(4, 1, "Replication"),
+(4, 2, "Load balancing"),
+(4, 3, "High availability"),
+(5, 0, "Conclusion");
+select * from table_24562;
+section	subsection	title
+1	0	Introduction
+1	1	Authors
+1	2	Acknowledgements
+2	0	Basics
+2	1	Syntax
+2	2	Client
+2	3	Server
+3	0	Intermediate
+3	1	Complex queries
+3	2	Stored Procedures
+3	3	Stored Functions
+4	0	Advanced
+4	1	Replication
+4	2	Load balancing
+4	3	High availability
+5	0	Conclusion
+alter table table_24562 add column reviewer varchar(20),
+order by title;
+select * from table_24562;
+section	subsection	title	reviewer
+1	2	Acknowledgements	NULL
+4	0	Advanced	NULL
+1	1	Authors	NULL
+2	0	Basics	NULL
+2	2	Client	NULL
+3	1	Complex queries	NULL
+5	0	Conclusion	NULL
+4	3	High availability	NULL
+3	0	Intermediate	NULL
+1	0	Introduction	NULL
+4	2	Load balancing	NULL
+4	1	Replication	NULL
+2	3	Server	NULL
+3	3	Stored Functions	NULL
+3	2	Stored Procedures	NULL
+2	1	Syntax	NULL
+update table_24562 set reviewer="Me" where section=2;
+update table_24562 set reviewer="You" where section=3;
+alter table table_24562
+order by section ASC, subsection DESC;
+select * from table_24562;
+section	subsection	title	reviewer
+1	2	Acknowledgements	NULL
+1	1	Authors	NULL
+1	0	Introduction	NULL
+2	3	Server	Me
+2	2	Client	Me
+2	1	Syntax	Me
+2	0	Basics	Me
+3	3	Stored Functions	You
+3	2	Stored Procedures	You
+3	1	Complex queries	You
+3	0	Intermediate	You
+4	3	High availability	NULL
+4	2	Load balancing	NULL
+4	1	Replication	NULL
+4	0	Advanced	NULL
+5	0	Conclusion	NULL
+alter table table_24562
+order by table_24562.subsection ASC, table_24562.section DESC;
+select * from table_24562;
+section	subsection	title	reviewer
+5	0	Conclusion	NULL
+4	0	Advanced	NULL
+3	0	Intermediate	You
+2	0	Basics	Me
+1	0	Introduction	NULL
+4	1	Replication	NULL
+3	1	Complex queries	You
+2	1	Syntax	Me
+1	1	Authors	NULL
+4	2	Load balancing	NULL
+3	2	Stored Procedures	You
+2	2	Client	Me
+1	2	Acknowledgements	NULL
+4	3	High availability	NULL
+3	3	Stored Functions	You
+2	3	Server	Me
+alter table table_24562 order by 12;
+ERROR 42000: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '12' at line 1
+alter table table_24562 order by (section + 12);
+ERROR 42000: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '(section + 12)' at line 1
+alter table table_24562 order by length(title);
+ERROR 42000: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'length(title)' at line 1
+alter table table_24562 order by (select 12 from dual);
+ERROR 42000: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '(select 12 from dual)' at line 1
+alter table table_24562 order by no_such_col;
+ERROR 42S22: Unknown column 'no_such_col' in 'order clause'
+drop table table_24562;
diff --git a/mysql-test/t/alter_table.test b/mysql-test/t/alter_table.test
index 3e1e7952af1..52a569dfb57 100644
--- a/mysql-test/t/alter_table.test
+++ b/mysql-test/t/alter_table.test
@@ -518,4 +518,70 @@ SHOW INDEX FROM bug24219_2;
 
 DROP TABLE bug24219_2;
 
+#
+# Bug#24562 (ALTER TABLE ... ORDER BY ... with complex expression asserts)
+#
+
+--disable_warnings
+drop table if exists table_24562;
+--enable_warnings
+
+create table table_24562(
+  section int,
+  subsection int,
+  title varchar(50));
+
+insert into table_24562 values
+(1, 0, "Introduction"),
+(1, 1, "Authors"),
+(1, 2, "Acknowledgements"),
+(2, 0, "Basics"),
+(2, 1, "Syntax"),
+(2, 2, "Client"),
+(2, 3, "Server"),
+(3, 0, "Intermediate"),
+(3, 1, "Complex queries"),
+(3, 2, "Stored Procedures"),
+(3, 3, "Stored Functions"),
+(4, 0, "Advanced"),
+(4, 1, "Replication"),
+(4, 2, "Load balancing"),
+(4, 3, "High availability"),
+(5, 0, "Conclusion");
+
+select * from table_24562;
+
+alter table table_24562 add column reviewer varchar(20),
+order by title;
+
+select * from table_24562;
+
+update table_24562 set reviewer="Me" where section=2;
+update table_24562 set reviewer="You" where section=3;
+
+alter table table_24562
+order by section ASC, subsection DESC;
+
+select * from table_24562;
+
+alter table table_24562
+order by table_24562.subsection ASC, table_24562.section DESC;
+
+select * from table_24562;
+
+--error 1064
+alter table table_24562 order by 12;
+--error 1064
+alter table table_24562 order by (section + 12);
+--error 1064
+alter table table_24562 order by length(title);
+--error 1064
+alter table table_24562 order by (select 12 from dual);
+
+--error 1054
+alter table table_24562 order by no_such_col;
+
+drop table table_24562;
+
 # End of 4.1 tests
+
diff --git a/sql/sql_yacc.yy b/sql/sql_yacc.yy
index 30283a47b21..ee57a4d611c 100644
--- a/sql/sql_yacc.yy
+++ b/sql/sql_yacc.yy
@@ -2021,7 +2021,7 @@ alter_list_item:
 	    lex->alter_info.is_simple= 0; 
 	    lex->alter_info.flags|= ALTER_OPTIONS;
 	  }
-	| order_clause         
+	| alter_order_clause
 	  {
 	    LEX *lex=Lex;
 	    lex->alter_info.is_simple= 0; 
@@ -3780,6 +3780,29 @@ olap_opt:
 	  }
 	;
 
+/*
+  Order by statement in ALTER TABLE
+*/
+
+alter_order_clause:
+          ORDER_SYM BY alter_order_list
+        ;
+
+alter_order_list:
+          alter_order_list ',' alter_order_item
+        | alter_order_item
+        ;
+
+alter_order_item:
+          simple_ident order_dir
+          {
+            THD *thd= YYTHD;
+            bool ascending= ($2 == 1) ? true : false;
+            if (add_order_to_list(thd, $1, ascending))
+              YYABORT;
+          }
+        ;
+
 /*
    Order by statement in select
 */

From 4064c89d2400a910e24813ce633f5c9522d1a321 Mon Sep 17 00:00:00 2001
From: "malff/marcsql@weblab.(none)" <>
Date: Thu, 18 Jan 2007 18:37:52 -0700
Subject: [PATCH 3/7] Manual merge

---
 mysql-test/r/alter_table.result | 113 ++++++++++++++++++++++++++++++++
 mysql-test/t/alter_table.test   |  10 +--
 sql/sql_yacc.yy                 |  25 ++++++-
 3 files changed, 142 insertions(+), 6 deletions(-)

diff --git a/mysql-test/r/alter_table.result b/mysql-test/r/alter_table.result
index 80ad50b886f..d8de2655c6c 100644
--- a/mysql-test/r/alter_table.result
+++ b/mysql-test/r/alter_table.result
@@ -703,6 +703,119 @@ SHOW INDEX FROM bug24219_2;
 Table	Non_unique	Key_name	Seq_in_index	Column_name	Collation	Cardinality	Sub_part	Packed	Null	Index_type	Comment
 bug24219_2	1	a	1	a	A	NULL	NULL	NULL	YES	BTREE	disabled
 DROP TABLE bug24219_2;
+drop table if exists table_24562;
+create table table_24562(
+section int,
+subsection int,
+title varchar(50));
+insert into table_24562 values
+(1, 0, "Introduction"),
+(1, 1, "Authors"),
+(1, 2, "Acknowledgements"),
+(2, 0, "Basics"),
+(2, 1, "Syntax"),
+(2, 2, "Client"),
+(2, 3, "Server"),
+(3, 0, "Intermediate"),
+(3, 1, "Complex queries"),
+(3, 2, "Stored Procedures"),
+(3, 3, "Stored Functions"),
+(4, 0, "Advanced"),
+(4, 1, "Replication"),
+(4, 2, "Load balancing"),
+(4, 3, "High availability"),
+(5, 0, "Conclusion");
+select * from table_24562;
+section	subsection	title
+1	0	Introduction
+1	1	Authors
+1	2	Acknowledgements
+2	0	Basics
+2	1	Syntax
+2	2	Client
+2	3	Server
+3	0	Intermediate
+3	1	Complex queries
+3	2	Stored Procedures
+3	3	Stored Functions
+4	0	Advanced
+4	1	Replication
+4	2	Load balancing
+4	3	High availability
+5	0	Conclusion
+alter table table_24562 add column reviewer varchar(20),
+order by title;
+select * from table_24562;
+section	subsection	title	reviewer
+1	2	Acknowledgements	NULL
+4	0	Advanced	NULL
+1	1	Authors	NULL
+2	0	Basics	NULL
+2	2	Client	NULL
+3	1	Complex queries	NULL
+5	0	Conclusion	NULL
+4	3	High availability	NULL
+3	0	Intermediate	NULL
+1	0	Introduction	NULL
+4	2	Load balancing	NULL
+4	1	Replication	NULL
+2	3	Server	NULL
+3	3	Stored Functions	NULL
+3	2	Stored Procedures	NULL
+2	1	Syntax	NULL
+update table_24562 set reviewer="Me" where section=2;
+update table_24562 set reviewer="You" where section=3;
+alter table table_24562
+order by section ASC, subsection DESC;
+select * from table_24562;
+section	subsection	title	reviewer
+1	2	Acknowledgements	NULL
+1	1	Authors	NULL
+1	0	Introduction	NULL
+2	3	Server	Me
+2	2	Client	Me
+2	1	Syntax	Me
+2	0	Basics	Me
+3	3	Stored Functions	You
+3	2	Stored Procedures	You
+3	1	Complex queries	You
+3	0	Intermediate	You
+4	3	High availability	NULL
+4	2	Load balancing	NULL
+4	1	Replication	NULL
+4	0	Advanced	NULL
+5	0	Conclusion	NULL
+alter table table_24562
+order by table_24562.subsection ASC, table_24562.section DESC;
+select * from table_24562;
+section	subsection	title	reviewer
+5	0	Conclusion	NULL
+4	0	Advanced	NULL
+3	0	Intermediate	You
+2	0	Basics	Me
+1	0	Introduction	NULL
+4	1	Replication	NULL
+3	1	Complex queries	You
+2	1	Syntax	Me
+1	1	Authors	NULL
+4	2	Load balancing	NULL
+3	2	Stored Procedures	You
+2	2	Client	Me
+1	2	Acknowledgements	NULL
+4	3	High availability	NULL
+3	3	Stored Functions	You
+2	3	Server	Me
+alter table table_24562 order by 12;
+ERROR 42000: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '12' at line 1
+alter table table_24562 order by (section + 12);
+ERROR 42000: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '(section + 12)' at line 1
+alter table table_24562 order by length(title);
+ERROR 42000: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'length(title)' at line 1
+alter table table_24562 order by (select 12 from dual);
+ERROR 42000: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '(select 12 from dual)' at line 1
+alter table table_24562 order by no_such_col;
+ERROR 42S22: Unknown column 'no_such_col' in 'order clause'
+drop table table_24562;
 create table t1 (mycol int(10) not null);
 alter table t1 alter column mycol set default 0;
 desc t1;
diff --git a/mysql-test/t/alter_table.test b/mysql-test/t/alter_table.test
index 68f984c65e1..01f55931ca4 100644
--- a/mysql-test/t/alter_table.test
+++ b/mysql-test/t/alter_table.test
@@ -579,16 +579,16 @@ order by table_24562.subsection ASC, table_24562.section DESC;
 
 select * from table_24562;
 
---error 1064
+--error ER_PARSE_ERROR
 alter table table_24562 order by 12;
---error 1064
+--error ER_PARSE_ERROR
 alter table table_24562 order by (section + 12);
---error 1064
+--error ER_PARSE_ERROR
 alter table table_24562 order by length(title);
---error 1064
+--error ER_PARSE_ERROR
 alter table table_24562 order by (select 12 from dual);
 
---error 1054
+--error ER_BAD_FIELD_ERROR
 alter table table_24562 order by no_such_col;
 
 drop table table_24562;
diff --git a/sql/sql_yacc.yy b/sql/sql_yacc.yy
index 92640ea58d6..0f29c3e1028 100644
--- a/sql/sql_yacc.yy
+++ b/sql/sql_yacc.yy
@@ -3722,7 +3722,7 @@ alter_list_item:
 	  {
 	    Lex->alter_info.flags|= ALTER_FORCE;
 	   }
-	| order_clause
+	| alter_order_clause
 	  {
 	    LEX *lex=Lex;
 	    lex->alter_info.flags|= ALTER_ORDER;
@@ -5942,6 +5942,29 @@ olap_opt:
 	  }
 	;
 
+/*
+  Order by statement in ALTER TABLE
+*/
+
+alter_order_clause:
+          ORDER_SYM BY alter_order_list
+        ;
+
+alter_order_list:
+          alter_order_list ',' alter_order_item
+        | alter_order_item
+        ;
+
+alter_order_item:
+          simple_ident_nospvar order_dir
+          {
+            THD *thd= YYTHD;
+            bool ascending= ($2 == 1) ? true : false;
+            if (add_order_to_list(thd, $1, ascending))
+              YYABORT;
+          }
+        ;
+
 /*
    Order by statement in select
 */

From 7b1a94ef78956cdcda7994faafafa5f349f6f123 Mon Sep 17 00:00:00 2001
From: "dlenev@mockturtle.local" <>
Date: Fri, 19 Jan 2007 23:15:59 +0300
Subject: [PATCH 4/7] Fix for bug #25044 "ALTER TABLE ... ENABLE KEYS acquires
 global 'opening tables' lock."

Execution of ALTER TABLE ... ENABLE KEYS on a table (which can take rather
long time) prevented concurrent execution of all statements using tables.

The problem was caused by the fact that we were holding LOCK_open mutex
during whole duration of this statement and particularly during call
to handler::enable_indexes(). This behavior was introduced as part of the
fix for bug 14262 "SP: DROP PROCEDURE|VIEW (maybe more) write to binlog
too late (race cond)"

The patch simply restores old behavior. Note that we can safely do this as
this operation takes exclusive lock (similar to name-lock) which blocks both
DML and DDL on the table being altered.

It also introduces mysql-test/include/wait_show_pattern.inc helper script
which is used to make test-case for this bug robust enough.
---
 mysql-test/include/wait_show_pattern.inc | 51 +++++++++++++++++++
 mysql-test/include/wait_slave_status.inc | 45 +++--------------
 mysql-test/r/alter_table-big.result      | 18 +++++++
 mysql-test/t/alter_table-big.test        | 62 ++++++++++++++++++++++++
 sql/sql_table.cc                         | 25 +++++++++-
 5 files changed, 162 insertions(+), 39 deletions(-)
 create mode 100644 mysql-test/include/wait_show_pattern.inc
 create mode 100644 mysql-test/r/alter_table-big.result
 create mode 100644 mysql-test/t/alter_table-big.test

diff --git a/mysql-test/include/wait_show_pattern.inc b/mysql-test/include/wait_show_pattern.inc
new file mode 100644
index 00000000000..c9f84ce7f08
--- /dev/null
+++ b/mysql-test/include/wait_show_pattern.inc
@@ -0,0 +1,51 @@
+# include/wait_show_pattern.inc
+#
+# SUMMARY
+#
+#   Waits until output produced by SHOW statement which particular type is
+#   specified as parameter matches certain pattern or maximum time reached.
+#
+# NOTES
+#
+#   Only the first row produced by the parameter statement is checked.
+#
+# USAGE
+#
+#   let $show_type= <Tail of SHOW statement>;
+#   let $show_pattern= 'Pattern to be used for LIKE matching';
+#   --source wait_show_pattern.inc
+#
+# EXAMPLES
+# 
+#   alter_table-big.test, wait_slave_status.inc
+#
+# SEE ALSO
+#
+#   wait_slave_status.inc, wait_condition.inc (>=5.1)
+#
+###############################################################################
+
+--disable_query_log
+
+# We accept to wait maximum 30 seconds (0.2 sec/loop).
+let $wait_counter= 150;
+while ($wait_counter)
+{
+  let $result= `SHOW $show_type`;
+  let $success= `SELECT '$result' LIKE $show_pattern`;
+  if ($success)
+  {
+    let $wait_counter= 0;
+  }
+  if (!$success)
+  {
+    real_sleep 0.2;
+    dec $wait_counter;
+  }
+}
+if (!$success)
+{
+  echo Timeout in wait_show_pattern.inc \$show_type= $show_type \$show_pattern= $show_pattern (\$result= '$result');
+}
+
+--enable_query_log
diff --git a/mysql-test/include/wait_slave_status.inc b/mysql-test/include/wait_slave_status.inc
index 7d3636e673c..d8d048527cf 100644
--- a/mysql-test/include/wait_slave_status.inc
+++ b/mysql-test/include/wait_slave_status.inc
@@ -104,50 +104,21 @@
 eval SELECT "let \$result_pattern= $result_pattern ;" AS "";
 SELECT '--source include/wait_slave_status.inc' AS "";
 
-# We accept to wait maximum 30 seconds (0.2 sec/loop).
-let $max_wait= 150;
-while ($max_wait)
-{
-    let $my_val= `SHOW SLAVE STATUS`;
-    # Now we have the first record of the SHOW result set as one fat string
-    # within the variable  $my_val.
-
-    eval SET @my_val = '$my_val';
-    # DEBUG eval SELECT @my_val AS "response to SHOW SLAVE STATUS";
-
-    eval SELECT @my_val LIKE $result_pattern INTO @success;
-    # @success is     '1' if we have a match
-    #                 '0' if we have no match
-    # DEBUG SELECT @success;
-
-    let $success= `SELECT @success`;
-    let $no_success= `SELECT @success = 0`;
-    if ($success)
-    {
-       # We reached the expected result and want to jump out of the loop
-       # without unneeded sleeps.
-       # Attention: Do not set $max_wait to 0, because "while" with negative value
-       #            does not work.
-       let $max_wait= 1;
-    }
-    if ($no_success)
-    {
-       # We did not reach the expected result and will have to sleep again
-       # or jump out of the loop, when max_wait is exhausted.
-       real_sleep 0.2;
-    }
-    dec $max_wait;
-}
+let $show_type= SLAVE STATUS;
+let $show_pattern= $result_pattern;
 --enable_query_log
-if ($no_success)
+
+--source include/wait_show_pattern.inc
+
+if (!$success)
 {
 let $message= ! Attention: Timeout in wait_slave_status.inc.
               |       Possible reasons with decreasing probability:
-              |       - The LIKE pattern ($result_pattern) is wrong, because the
+              |       - The LIKE pattern is wrong, because the
               |         testcase was altered or the layout of the
               |         SHOW SLAVE STATUS result set changed.
               |       - There is a new bug within the replication.
-              |       - We met an extreme testing environment and $max_wait is
+              |       - We met an extreme testing environment and timeout is
               |         too small.;
 --source include/show_msg80.inc
 --echo DEBUG INFO START (wait_slave_status.inc):
diff --git a/mysql-test/r/alter_table-big.result b/mysql-test/r/alter_table-big.result
new file mode 100644
index 00000000000..873978c60de
--- /dev/null
+++ b/mysql-test/r/alter_table-big.result
@@ -0,0 +1,18 @@
+drop table if exists t1, t2;
+create table t1 (n1 int, n2 int, n3 int,
+key (n1, n2, n3),
+key (n2, n3, n1),
+key (n3, n1, n2));
+create table t2 (i int);
+alter table t1 disable keys;
+reset master;
+alter table t1 enable keys;;
+insert into t2 values (1);
+insert into t1 values (1, 1, 1);
+show binlog events in 'master-bin.000001' from 98;
+Log_name	Pos	Event_type	Server_id	End_log_pos	Info
+master-bin.000001	#	Query	1	#	use `test`; insert into t2 values (1)
+master-bin.000001	#	Query	1	#	use `test`; alter table t1 enable keys
+master-bin.000001	#	Query	1	#	use `test`; insert into t1 values (1, 1, 1)
+drop tables t1, t2;
+End of 5.0 tests
diff --git a/mysql-test/t/alter_table-big.test b/mysql-test/t/alter_table-big.test
new file mode 100644
index 00000000000..9a773f48a9c
--- /dev/null
+++ b/mysql-test/t/alter_table-big.test
@@ -0,0 +1,62 @@
+# In order to be more or less robust test for bug#25044 has to take
+# significant time (e.g. about 9 seconds on my (Dmitri's) computer)
+# so we probably want execute it only in --big-test mode.
+# Also in 5.1 this test will require statement-based binlog.
+--source include/big_test.inc
+
+
+#
+# Test for bug #25044 "ALTER TABLE ... ENABLE KEYS acquires global
+# 'opening tables' lock".
+#
+# ALTER TABLE ... ENABLE KEYS should not acquire LOCK_open mutex for
+# the whole its duration as it prevents other queries from execution.
+--disable_warnings
+drop table if exists t1, t2;
+--enable_warnings
+connect (addconroot, localhost, root,,);
+connection default;
+create table t1 (n1 int, n2 int, n3 int,
+                key (n1, n2, n3),
+                key (n2, n3, n1),
+                key (n3, n1, n2));
+create table t2 (i int);
+
+# Populating 't1' table with keys disabled, so ALTER TABLE .. ENABLE KEYS
+# will run for some time
+alter table t1 disable keys;
+--disable_query_log
+insert into t1 values (RAND()*1000,RAND()*1000,RAND()*1000);
+let $1=19;
+while ($1)
+{
+ eval insert into t1 select RAND()*1000,RAND()*1000,RAND()*1000 from t1;
+ dec $1;
+}
+--enable_query_log
+
+# Later we use binlog to check the order in which statements are
+# executed so let us reset it first.
+reset master;
+--send alter table t1 enable keys;
+connection addconroot;
+let $show_type= PROCESSLIST;
+let $show_pattern= '%Repair by sorting%alter table t1 enable keys%';
+--source include/wait_show_pattern.inc
+# This statement should not be blocked by in-flight ALTER and therefore
+# should be executed and written to binlog before ALTER TABLE ... ENABLE KEYS
+# finishes.
+insert into t2 values (1);
+# And this should wait until the end of ALTER TABLE ... ENABLE KEYS.
+insert into t1 values (1, 1, 1);
+connection default;
+--reap
+# Check that statements were executed/binlogged in correct order.
+--replace_column 2 # 5 #
+show binlog events in 'master-bin.000001' from 98;
+
+# Clean up
+drop tables t1, t2;
+
+
+--echo End of 5.0 tests
diff --git a/sql/sql_table.cc b/sql/sql_table.cc
index b3bd3182a59..88c9be9ff59 100644
--- a/sql/sql_table.cc
+++ b/sql/sql_table.cc
@@ -3146,19 +3146,30 @@ view_err:
   if (!(alter_info->flags & ~(ALTER_RENAME | ALTER_KEYS_ONOFF)) &&
       !table->s->tmp_table) // no need to touch frm
   {
-    VOID(pthread_mutex_lock(&LOCK_open));
-
     switch (alter_info->keys_onoff) {
     case LEAVE_AS_IS:
       error= 0;
       break;
     case ENABLE:
+      /*
+        wait_while_table_is_used() ensures that table being altered is
+        opened only by this thread and that TABLE::TABLE_SHARE::version
+        of TABLE object corresponding to this table is 0.
+        The latter guarantees that no DML statement will open this table
+        until ALTER TABLE finishes (i.e. until close_thread_tables())
+        while the fact that the table is still open gives us protection
+        from concurrent DDL statements.
+      */
+      VOID(pthread_mutex_lock(&LOCK_open));
       wait_while_table_is_used(thd, table, HA_EXTRA_FORCE_REOPEN);
+      VOID(pthread_mutex_unlock(&LOCK_open));
       error= table->file->enable_indexes(HA_KEY_SWITCH_NONUNIQ_SAVE);
       /* COND_refresh will be signaled in close_thread_tables() */
       break;
     case DISABLE:
+      VOID(pthread_mutex_lock(&LOCK_open));
       wait_while_table_is_used(thd, table, HA_EXTRA_FORCE_REOPEN);
+      VOID(pthread_mutex_unlock(&LOCK_open));
       error=table->file->disable_indexes(HA_KEY_SWITCH_NONUNIQ_SAVE);
       /* COND_refresh will be signaled in close_thread_tables() */
       break;
@@ -3171,6 +3182,16 @@ view_err:
       error= 0;
     }
 
+    VOID(pthread_mutex_lock(&LOCK_open));
+    /*
+      Unlike to the above case close_cached_table() below will remove ALL
+      instances of TABLE from table cache (it will also remove table lock
+      held by this thread). So to make actual table renaming and writing
+      to binlog atomic we have to put them into the same critical section
+      protected by LOCK_open mutex. This also removes gap for races between
+      access() and mysql_rename_table() calls.
+    */
+
     if (!error && (new_name != table_name || new_db != db))
     {
       thd->proc_info="rename";

From ddffdd1c7428be7a769d14214d7a5121cecbe57b Mon Sep 17 00:00:00 2001
From: "anozdrin/alik@alik." <>
Date: Mon, 22 Jan 2007 20:00:27 +0300
Subject: [PATCH 5/7] Enabling im_daemon_life_cycle.imtest in team tree.

Do not propagate this change into main trees.
---
 mysql-test/t/disabled.def | 1 -
 1 file changed, 1 deletion(-)

diff --git a/mysql-test/t/disabled.def b/mysql-test/t/disabled.def
index 3213bd4eb5b..53b73363c22 100644
--- a/mysql-test/t/disabled.def
+++ b/mysql-test/t/disabled.def
@@ -10,7 +10,6 @@
 #
 ##############################################################################
 
-im_daemon_life_cycle     : Bug#24415  see note: [19 Dec 23:17] Trudy Pelzer
 ndb_load        : Bug#17233
 user_limits     : Bug#23921 random failure of user_limits.test
 flush2          : Bug#24805 Pushbuild can't handle test with --disable-log-bin

From 2b63f106014a825b816c4506baf4c2aac1e9e99e Mon Sep 17 00:00:00 2001
From: "dlenev@mockturtle.local" <>
Date: Tue, 23 Jan 2007 15:03:48 +0300
Subject: [PATCH 6/7] Proposed fix for bug#24491 "using alias from source table
 in insert ... on duplicate key".

INSERT ... SELECT ... ON DUPLICATE KEY UPDATE which was used in
stored routine or as prepared statement and which in its ON DUPLICATE
KEY clause erroneously tried to assign value to a column mentioned only
in its SELECT part was properly emitting error on the first execution
but succeeded on the second and following executions.

Code which is responsible for name resolution of fields mentioned in
UPDATE clause (e.g. see select_insert::prepare()) modifies table list
and Name_resolution_context used in this process. It uses
Name_resolution_context_state::save_state/restore_state() to revert
these modifications. Unfortunately those two methods failed to revert
properly modifications to TABLE_LIST::next_name_resolution_table
and this broke name resolution process for successive executions.

This patch fixes Name_resolution_context_state::save_state/restore_state()
in such way that it properly handles TABLE_LIST::next_name_resolution_table.
---
 mysql-test/r/ps.result       | 16 ++++++++++++++++
 mysql-test/r/sp-error.result | 19 +++++++++++++++++++
 mysql-test/t/ps.test         | 30 ++++++++++++++++++++++++++++++
 mysql-test/t/sp-error.test   | 32 ++++++++++++++++++++++++++++++++
 sql/item.h                   |  9 ++-------
 5 files changed, 99 insertions(+), 7 deletions(-)

diff --git a/mysql-test/r/ps.result b/mysql-test/r/ps.result
index eb07bb8e672..279e89150da 100644
--- a/mysql-test/r/ps.result
+++ b/mysql-test/r/ps.result
@@ -1496,4 +1496,20 @@ Variable_name	Value
 Slow_queries	1
 deallocate prepare no_index;
 deallocate prepare sq;
+drop tables if exists t1;
+create table t1 (id int primary key auto_increment, value varchar(10));
+insert into t1 (id, value) values (1, 'FIRST'), (2, 'SECOND'), (3, 'THIRD');
+prepare stmt from "insert into t1 (id, value) select * from (select 4 as i, 'FOURTH' as v) as y on duplicate key update v = 'DUP'";
+execute stmt;
+ERROR 42S22: Unknown column 'v' in 'field list'
+execute stmt;
+ERROR 42S22: Unknown column 'v' in 'field list'
+deallocate prepare stmt;
+prepare stmt from "insert into t1 (id, value) select * from (select 4 as id, 'FOURTH' as value) as y on duplicate key update y.value = 'DUP'";
+execute stmt;
+ERROR 42S22: Unknown column 'y.value' in 'field list'
+execute stmt;
+ERROR 42S22: Unknown column 'y.value' in 'field list'
+deallocate prepare stmt;
+drop tables t1;
 End of 5.0 tests.
diff --git a/mysql-test/r/sp-error.result b/mysql-test/r/sp-error.result
index 63fd1bfff6d..e7e387f4348 100644
--- a/mysql-test/r/sp-error.result
+++ b/mysql-test/r/sp-error.result
@@ -1250,3 +1250,22 @@ ERROR HY000: View's SELECT contains a variable or parameter
 PREPARE stmt FROM "CREATE VIEW v AS SELECT ?";
 ERROR HY000: View's SELECT contains a variable or parameter
 DROP TABLE t1;
+drop tables if exists t1;
+drop procedure if exists bug24491;
+create table t1 (id int primary key auto_increment, value varchar(10));
+insert into t1 (id, value) values (1, 'FIRST'), (2, 'SECOND'), (3, 'THIRD');
+create procedure bug24491()
+insert into t1 (id, value) select * from (select 4 as i, 'FOURTH' as v) as y on duplicate key update v = 'DUP';
+call bug24491();
+ERROR 42S22: Unknown column 'v' in 'field list'
+call bug24491();
+ERROR 42S22: Unknown column 'v' in 'field list'
+drop procedure bug24491;
+create procedure bug24491()
+insert into t1 (id, value) select * from (select 4 as id, 'FOURTH' as value) as y on duplicate key update y.value = 'DUP';
+call bug24491();
+ERROR 42S22: Unknown column 'y.value' in 'field list'
+call bug24491();
+ERROR 42S22: Unknown column 'y.value' in 'field list'
+drop procedure bug24491;
+drop tables t1;
diff --git a/mysql-test/t/ps.test b/mysql-test/t/ps.test
index 1c8d7b419a3..2059f2fb080 100644
--- a/mysql-test/t/ps.test
+++ b/mysql-test/t/ps.test
@@ -1540,4 +1540,34 @@ execute sq;
 deallocate prepare no_index;
 deallocate prepare sq;
 
+
+#
+# BUG#24491 "using alias from source table in insert ... on duplicate key"
+#
+--disable_warnings
+drop tables if exists t1;
+--enable_warnings
+create table t1 (id int primary key auto_increment, value varchar(10));
+insert into t1 (id, value) values (1, 'FIRST'), (2, 'SECOND'), (3, 'THIRD');
+# Let us prepare INSERT ... SELECT ... ON DUPLICATE KEY UPDATE statement
+# which in its ON DUPLICATE KEY clause erroneously tries to assign value
+# to a column which is mentioned only in SELECT part.
+prepare stmt from "insert into t1 (id, value) select * from (select 4 as i, 'FOURTH' as v) as y on duplicate key update v = 'DUP'";
+# Both first and second attempts to execute it should fail
+--error ER_BAD_FIELD_ERROR 
+execute stmt;
+--error ER_BAD_FIELD_ERROR
+execute stmt;
+deallocate prepare stmt;
+# And now the same test for more complex case which is more close
+# to the one that was reported originally.
+prepare stmt from "insert into t1 (id, value) select * from (select 4 as id, 'FOURTH' as value) as y on duplicate key update y.value = 'DUP'";
+--error ER_BAD_FIELD_ERROR 
+execute stmt;
+--error ER_BAD_FIELD_ERROR
+execute stmt;
+deallocate prepare stmt;
+drop tables t1;
+
+
 --echo End of 5.0 tests.
diff --git a/mysql-test/t/sp-error.test b/mysql-test/t/sp-error.test
index 77bd5259eb5..e77e3df8301 100644
--- a/mysql-test/t/sp-error.test
+++ b/mysql-test/t/sp-error.test
@@ -1808,6 +1808,38 @@ PREPARE stmt FROM "CREATE VIEW v AS SELECT ?";
 DROP TABLE t1;
 
 
+#
+# BUG#24491 "using alias from source table in insert ... on duplicate key"
+#
+--disable_warnings
+drop tables if exists t1;
+drop procedure if exists bug24491;
+--enable_warnings
+create table t1 (id int primary key auto_increment, value varchar(10));
+insert into t1 (id, value) values (1, 'FIRST'), (2, 'SECOND'), (3, 'THIRD');
+# Let us create routine with INSERT ... SELECT ... ON DUPLICATE KEY UPDATE 
+# statement which in its ON DUPLICATE KEY clause erroneously tries to assign
+# value to a column which is mentioned only in SELECT part.
+create procedure bug24491()
+  insert into t1 (id, value) select * from (select 4 as i, 'FOURTH' as v) as y on duplicate key update v = 'DUP';
+# Both first and second calls to it should fail
+--error ER_BAD_FIELD_ERROR 
+call bug24491();
+--error ER_BAD_FIELD_ERROR
+call bug24491();
+drop procedure bug24491;
+# And now the same test for more complex case which is more close
+# to the one that was reported originally.
+create procedure bug24491()
+  insert into t1 (id, value) select * from (select 4 as id, 'FOURTH' as value) as y on duplicate key update y.value = 'DUP';
+--error ER_BAD_FIELD_ERROR 
+call bug24491();
+--error ER_BAD_FIELD_ERROR
+call bug24491();
+drop procedure bug24491;
+drop tables t1;
+
+
 #
 # BUG#NNNN: New bug synopsis
 #
diff --git a/sql/item.h b/sql/item.h
index 63d89113ec1..7c6aa39cadf 100644
--- a/sql/item.h
+++ b/sql/item.h
@@ -337,23 +337,18 @@ public:
   {
     save_table_list=                  context->table_list;
     save_first_name_resolution_table= context->first_name_resolution_table;
-    save_next_name_resolution_table=  (context->first_name_resolution_table) ?
-                                      context->first_name_resolution_table->
-                                               next_name_resolution_table :
-                                      NULL;
     save_resolve_in_select_list=      context->resolve_in_select_list;
     save_next_local=                  table_list->next_local;
+    save_next_name_resolution_table=  table_list->next_name_resolution_table;
   }
 
   /* Restore a name resolution context from saved state. */
   void restore_state(Name_resolution_context *context, TABLE_LIST *table_list)
   {
     table_list->next_local=                save_next_local;
+    table_list->next_name_resolution_table= save_next_name_resolution_table;
     context->table_list=                   save_table_list;
     context->first_name_resolution_table=  save_first_name_resolution_table;
-    if (context->first_name_resolution_table)
-      context->first_name_resolution_table->
-               next_name_resolution_table= save_next_name_resolution_table;
     context->resolve_in_select_list=       save_resolve_in_select_list;
   }
 };

From 37110aad7ff5520c65ccdd0ce9e5233a0277b3e2 Mon Sep 17 00:00:00 2001
From: "dlenev@mockturtle.local" <>
Date: Wed, 24 Jan 2007 22:11:27 +0300
Subject: [PATCH 7/7] Disabling back im_daemon_life_cycle.test, which was
 temporarily enabled in the team tree for additional investigation.

---
 mysql-test/t/disabled.def | 1 +
 1 file changed, 1 insertion(+)

diff --git a/mysql-test/t/disabled.def b/mysql-test/t/disabled.def
index 53b73363c22..3213bd4eb5b 100644
--- a/mysql-test/t/disabled.def
+++ b/mysql-test/t/disabled.def
@@ -10,6 +10,7 @@
 #
 ##############################################################################
 
+im_daemon_life_cycle     : Bug#24415  see note: [19 Dec 23:17] Trudy Pelzer
 ndb_load        : Bug#17233
 user_limits     : Bug#23921 random failure of user_limits.test
 flush2          : Bug#24805 Pushbuild can't handle test with --disable-log-bin