From f5f9c922c864556044c606e804bec3780236b885 Mon Sep 17 00:00:00 2001
From: "karen.langford@oracle.com" <>
Date: Tue, 22 Jun 2010 19:21:25 +0200
Subject: [PATCH 01/18] Set version number for mysql-5.1.46sp1 release

---
 configure.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configure.in b/configure.in
index 904c54abb5f..9098ed1f3cb 100644
--- a/configure.in
+++ b/configure.in
@@ -12,7 +12,7 @@ dnl
 dnl When changing the major version number please also check the switch
 dnl statement in mysqlbinlog::check_master_version().  You may also need
 dnl to update version.c in ndb.
-AC_INIT([MySQL Server], [5.1.46], [], [mysql])
+AC_INIT([MySQL Server], [5.1.46sp1], [], [mysql])
 
 AC_CONFIG_SRCDIR([sql/mysqld.cc])
 AC_CANONICAL_SYSTEM

From d4858b96d3ffdd162f0273f106e99f76a334ed2f Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Jun 2010 21:42:14 +0200
Subject: [PATCH 02/18] Backport into build-201006221614-5.1.46sp1

> ------------------------------------------------------------
> revno: 3362
> revision-id: davi.arnaut@sun.com-20100401131522-895y8uzvv8ag44gs
> parent: ramil@mysql.com-20100429045409-r7r5lcyiruis15v7
> committer: Davi Arnaut <Davi.Arnaut@Sun.COM>
> branch nick: 50755-5.1
> timestamp: Thu 2010-04-01 10:15:22 -0300
> message:
>   Bug#50755: Crash if stored routine def contains version comments
>
>   The problem was that a syntactically invalid trigger could cause
>   the server to crash when trying to list triggers. The crash would
>   happen due to a mishap in the backup/restore procedure that should
>   protect parser items which are not associated with the trigger. The
>   backup/restore is used to isolate the parse tree (and context) of
>   a statement from the load (and parsing) of a trigger. In this case,
>   a error during the parsing of a trigger could cause the improper
>   backup/restore sequence.
>
>   The solution is to properly restore the original statement context
>   before the parser is exited due to syntax errors in the trigger body.
---
 mysql-test/r/trigger.result | 23 +++++++++++++++++++++++
 mysql-test/t/trigger.test   | 31 +++++++++++++++++++++++++++++++
 sql/sp_head.cc              | 36 ++++++++++++++----------------------
 sql/sp_head.h               |  4 ----
 sql/sql_lex.cc              |  1 +
 5 files changed, 69 insertions(+), 26 deletions(-)

diff --git a/mysql-test/r/trigger.result b/mysql-test/r/trigger.result
index 3446babbb52..e3c0b0e1dd9 100644
--- a/mysql-test/r/trigger.result
+++ b/mysql-test/r/trigger.result
@@ -2128,4 +2128,27 @@ Warning	1048	Column 'id' cannot be null
 Warning	1048	Column 'id' cannot be null
 DROP TRIGGER t1_bu;
 DROP TABLE t1,t2;
+#
+# Bug#50755: Crash if stored routine def contains version comments
+#
+DROP DATABASE IF EXISTS db1;
+DROP TRIGGER IF EXISTS trg1;
+DROP TABLE IF EXISTS t1, t2;
+CREATE DATABASE db1;
+USE db1;
+CREATE TABLE t1 (b INT);
+CREATE TABLE t2 (a INT);
+CREATE TRIGGER trg1 BEFORE INSERT ON t2 FOR EACH ROW INSERT/*!INTO*/t1 VALUES (1);
+# Used to crash
+SHOW TRIGGERS IN db1;
+Trigger	Event	Table	Statement	Timing	Created	sql_mode	Definer	character_set_client	collation_connection	Database Collation
+Warnings:
+Warning	1064	You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'VALUES (1)' at line 1
+INSERT INTO t2 VALUES (1);
+ERROR 42000: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'VALUES (1)' at line 1
+SELECT * FROM t1;
+b
+# Work around Bug#45235
+DROP DATABASE db1;
+USE test;
 End of 5.1 tests.
diff --git a/mysql-test/t/trigger.test b/mysql-test/t/trigger.test
index 368271f1fb2..bcbca4d2139 100644
--- a/mysql-test/t/trigger.test
+++ b/mysql-test/t/trigger.test
@@ -2439,4 +2439,35 @@ UPDATE t1 SET id=NULL;
 DROP TRIGGER t1_bu;
 DROP TABLE t1,t2;
 
+--echo #
+--echo # Bug#50755: Crash if stored routine def contains version comments
+--echo #
+
+--disable_warnings
+DROP DATABASE IF EXISTS db1;
+DROP TRIGGER IF EXISTS trg1;
+DROP TABLE IF EXISTS t1, t2;
+--enable_warnings
+
+CREATE DATABASE db1;
+USE db1;
+
+CREATE TABLE t1 (b INT);
+CREATE TABLE t2 (a INT);
+
+CREATE TRIGGER trg1 BEFORE INSERT ON t2 FOR EACH ROW INSERT/*!INTO*/t1 VALUES (1);
+--echo # Used to crash
+SHOW TRIGGERS IN db1;
+--error ER_PARSE_ERROR
+INSERT INTO t2 VALUES (1);
+SELECT * FROM t1;
+
+--echo # Work around Bug#45235
+let $MYSQLD_DATADIR = `select @@datadir`;
+--remove_file $MYSQLD_DATADIR/db1/t2.TRG
+--remove_file $MYSQLD_DATADIR/db1/trg1.TRN
+
+DROP DATABASE db1;
+USE test;
+
 --echo End of 5.1 tests.
diff --git a/sql/sp_head.cc b/sql/sp_head.cc
index 11d5e5f830b..cadda38053c 100644
--- a/sql/sp_head.cc
+++ b/sql/sp_head.cc
@@ -745,21 +745,12 @@ sp_head::create(THD *thd)
 
 sp_head::~sp_head()
 {
-  DBUG_ENTER("sp_head::~sp_head");
-  destroy();
-  delete m_next_cached_sp;
-  if (m_thd)
-    restore_thd_mem_root(m_thd);
-  DBUG_VOID_RETURN;
-}
-
-void
-sp_head::destroy()
-{
-  sp_instr *i;
   LEX *lex;
-  DBUG_ENTER("sp_head::destroy");
-  DBUG_PRINT("info", ("name: %s", m_name.str));
+  sp_instr *i;
+  DBUG_ENTER("sp_head::~sp_head");
+
+  /* sp_head::restore_thd_mem_root() must already have been called. */
+  DBUG_ASSERT(m_thd == NULL);
 
   for (uint ip = 0 ; (i = get_instr(ip)) ; ip++)
     delete i;
@@ -770,21 +761,22 @@ sp_head::destroy()
   /*
     If we have non-empty LEX stack then we just came out of parser with
     error. Now we should delete all auxilary LEXes and restore original
-    THD::lex (In this case sp_head::restore_thd_mem_root() was not called
-    too, so m_thd points to the current thread context).
-    It is safe to not update LEX::ptr because further query string parsing
-    and execution will be stopped anyway.
+    THD::lex. It is safe to not update LEX::ptr because further query
+    string parsing and execution will be stopped anyway.
   */
-  DBUG_ASSERT(m_lex.is_empty() || m_thd);
   while ((lex= (LEX *)m_lex.pop()))
   {
-    lex_end(m_thd->lex);
-    delete m_thd->lex;
-    m_thd->lex= lex;
+    THD *thd= lex->thd;
+    lex_end(thd->lex);
+    delete thd->lex;
+    thd->lex= lex;
   }
 
   hash_free(&m_sptabs);
   hash_free(&m_sroutines);
+
+  delete m_next_cached_sp;
+
   DBUG_VOID_RETURN;
 }
 
diff --git a/sql/sp_head.h b/sql/sp_head.h
index 00c96d44f70..d422adc8927 100644
--- a/sql/sp_head.h
+++ b/sql/sp_head.h
@@ -289,10 +289,6 @@ public:
 
   virtual ~sp_head();
 
-  /// Free memory
-  void
-  destroy();
-
   bool
   execute_trigger(THD *thd,
                   const LEX_STRING *db_name,
diff --git a/sql/sql_lex.cc b/sql/sql_lex.cc
index 5097ca2ad5b..a3776f59241 100644
--- a/sql/sql_lex.cc
+++ b/sql/sql_lex.cc
@@ -2106,6 +2106,7 @@ void st_lex::cleanup_lex_after_parse_error(THD *thd)
   */
   if (thd->lex->sphead)
   {
+    thd->lex->sphead->restore_thd_mem_root(thd);
     delete thd->lex->sphead;
     thd->lex->sphead= NULL;
   }

From 98cfc9e61e9d061ff6803c3e371febde282a97a1 Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Jun 2010 21:50:47 +0200
Subject: [PATCH 03/18] Backport into build-201006221614-5.1.46sp1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

> ------------------------------------------------------------
> revno: 3351.14.50
> revision-id: marko.makela@oracle.com-20100421185359-8qaxoa2yyrpzwdd7
> parent: marko.makela@oracle.com-20100421102723-0i80uezbyu0ekj5d
> committer: Marko Mäkelä <marko.makela@oracle.com>
> branch nick: 5.1-innodb
> timestamp: Wed 2010-04-21 21:53:59 +0300
> message:
>   btr_page_split_and_insert(): Avoid an infinite loop. (Bug #52964)
>
>   btr_page_tuple_smaller(): New function, refactored from
>   btr_page_split_and_insert().
>
>   btr_page_get_split_rec(): Renamed from btr_page_get_sure_split_rec().
>   Note that a NULL return may mean that the tuple is to be inserted into
>   either the lower or upper page, to be determined by btr_page_tuple_smaller().
>
>   btr_page_split_and_insert(): When btr_page_get_split_rec() returns NULL,
>   invoke btr_page_tuple_smaller() to determine which half-page the tuple
>   belongs to.
>
>   Reviewed by Sunny Bains
---
 storage/innodb_plugin/btr/btr0btr.c | 91 +++++++++++++++++++----------
 1 file changed, 59 insertions(+), 32 deletions(-)

diff --git a/storage/innodb_plugin/btr/btr0btr.c b/storage/innodb_plugin/btr/btr0btr.c
index fa4fc05d96b..cd8f42b3818 100644
--- a/storage/innodb_plugin/btr/btr0btr.c
+++ b/storage/innodb_plugin/btr/btr0btr.c
@@ -1451,11 +1451,11 @@ Calculates a split record such that the tuple will certainly fit on
 its half-page when the split is performed. We assume in this function
 only that the cursor page has at least one user record.
 @return split record, or NULL if tuple will be the first record on
-upper half-page */
+the lower or upper half-page (determined by btr_page_tuple_smaller()) */
 static
 rec_t*
-btr_page_get_sure_split_rec(
-/*========================*/
+btr_page_get_split_rec(
+/*===================*/
 	btr_cur_t*	cursor,	/*!< in: cursor at which insert should be made */
 	const dtuple_t*	tuple,	/*!< in: tuple to insert */
 	ulint		n_ext)	/*!< in: number of externally stored columns */
@@ -1831,6 +1831,37 @@ btr_attach_half_pages(
 	btr_page_set_next(upper_page, upper_page_zip, next_page_no, mtr);
 }
 
+/*************************************************************//**
+Determine if a tuple is smaller than any record on the page.
+@return TRUE if smaller */
+static
+ibool
+btr_page_tuple_smaller(
+/*===================*/
+	btr_cur_t*	cursor,	/*!< in: b-tree cursor */
+	const dtuple_t*	tuple,	/*!< in: tuple to consider */
+	ulint*		offsets,/*!< in/out: temporary storage */
+	ulint		n_uniq,	/*!< in: number of unique fields
+				in the index page records */
+	mem_heap_t**	heap)	/*!< in/out: heap for offsets */
+{
+	buf_block_t*	block;
+	const rec_t*	first_rec;
+	page_cur_t	pcur;
+
+	/* Read the first user record in the page. */
+	block = btr_cur_get_block(cursor);
+	page_cur_set_before_first(block, &pcur);
+	page_cur_move_to_next(&pcur);
+	first_rec = page_cur_get_rec(&pcur);
+
+	offsets = rec_get_offsets(
+		first_rec, cursor->index, offsets,
+		n_uniq, heap);
+
+	return(cmp_dtuple_rec(tuple, first_rec, offsets) < 0);
+}
+
 /*************************************************************//**
 Splits an index page to halves and inserts the tuple. It is assumed
 that mtr holds an x-latch to the index tree. NOTE: the tree x-latch is
@@ -1905,49 +1936,45 @@ func_start:
 	if (n_iterations > 0) {
 		direction = FSP_UP;
 		hint_page_no = page_no + 1;
-		split_rec = btr_page_get_sure_split_rec(cursor, tuple, n_ext);
+		split_rec = btr_page_get_split_rec(cursor, tuple, n_ext);
 
+		if (UNIV_UNLIKELY(split_rec == NULL)) {
+			insert_left = btr_page_tuple_smaller(
+				cursor, tuple, offsets, n_uniq, &heap);
+		}
 	} else if (btr_page_get_split_rec_to_right(cursor, &split_rec)) {
 		direction = FSP_UP;
 		hint_page_no = page_no + 1;
+		insert_left = FALSE;
 
 	} else if (btr_page_get_split_rec_to_left(cursor, &split_rec)) {
 		direction = FSP_DOWN;
 		hint_page_no = page_no - 1;
+		ut_ad(split_rec);
 	} else {
 		direction = FSP_UP;
 		hint_page_no = page_no + 1;
 
-		if (page_get_n_recs(page) == 1) {
-			page_cur_t	pcur;
+		/* If there is only one record in the index page, we
+		can't split the node in the middle by default. We need
+		to determine whether the new record will be inserted
+		to the left or right. */
 
-			/* There is only one record in the index page
-			therefore we can't split the node in the middle
-			by default. We need to determine whether the
-			new record will be inserted to the left or right. */
-
-			/* Read the first (and only) record in the page. */
-			page_cur_set_before_first(block, &pcur);
-			page_cur_move_to_next(&pcur);
-			first_rec = page_cur_get_rec(&pcur);
-
-			offsets = rec_get_offsets(
-				first_rec, cursor->index, offsets,
-				n_uniq, &heap);
-
-			/* If the new record is less than the existing record
-			the split in the middle will copy the existing
-			record to the new node. */
-			if (cmp_dtuple_rec(tuple, first_rec, offsets) < 0) {
-				split_rec = page_get_middle_rec(page);
-			} else {
-				split_rec = NULL;
-			}
-		} else {
+		if (page_get_n_recs(page) > 1) {
 			split_rec = page_get_middle_rec(page);
+		} else if (btr_page_tuple_smaller(cursor, tuple,
+						  offsets, n_uniq, &heap)) {
+			split_rec = page_rec_get_next(
+				page_get_infimum_rec(page));
+		} else {
+			split_rec = NULL;
+			insert_left = FALSE;
 		}
 	}
 
+	/* At this point, insert_left is initialized if split_rec == NULL
+	and may be uninitialized otherwise. */
+
 	/* 2. Allocate a new page to the index */
 	new_block = btr_page_alloc(cursor->index, hint_page_no, direction,
 				   btr_page_get_level(page, mtr), mtr);
@@ -1974,11 +2001,11 @@ func_start:
 			avoid further splits by inserting the record
 			to an empty page. */
 			split_rec = NULL;
-			goto insert_right;
+			goto insert_empty;
 		}
 	} else {
-insert_right:
-		insert_left = FALSE;
+insert_empty:
+		ut_ad(!split_rec);
 		buf = mem_alloc(rec_get_converted_size(cursor->index,
 						       tuple, n_ext));
 

From 01ca7cff6fd255a630f26f9112774d324aa8a4f7 Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Jun 2010 21:52:43 +0200
Subject: [PATCH 04/18] Backport into build-201006221614-5.1.46sp1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

> ------------------------------------------------------------
> revno: 3351.14.74
> revision-id: marko.makela@oracle.com-20100504093128-44v6glupe1dsh0ug
> parent: marko.makela@oracle.com-20100503122859-k73bl51re93o0mt4
> committer: Marko Mäkelä <marko.makela@oracle.com>
> branch nick: 5.1-innodb
> timestamp: Tue 2010-05-04 12:31:28 +0300
> message:
>   btr_page_split_and_insert(): Correct the fix of Bug #52964.
>   When split_rec==NULL, choose the correct node pointer key (first_rec).
---
 storage/innodb_plugin/btr/btr0btr.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/storage/innodb_plugin/btr/btr0btr.c b/storage/innodb_plugin/btr/btr0btr.c
index cd8f42b3818..1d6b4f5a0e6 100644
--- a/storage/innodb_plugin/btr/btr0btr.c
+++ b/storage/innodb_plugin/btr/btr0btr.c
@@ -2003,9 +2003,13 @@ func_start:
 			split_rec = NULL;
 			goto insert_empty;
 		}
+	} else if (UNIV_UNLIKELY(insert_left)) {
+		first_rec = page_rec_get_next(page_get_infimum_rec(page));
+		move_limit = page_rec_get_next(btr_cur_get_rec(cursor));
 	} else {
 insert_empty:
 		ut_ad(!split_rec);
+		ut_ad(!insert_left);
 		buf = mem_alloc(rec_get_converted_size(cursor->index,
 						       tuple, n_ext));
 
@@ -2029,7 +2033,11 @@ insert_empty:
 			&& btr_page_insert_fits(cursor, split_rec,
 						offsets, tuple, n_ext, heap);
 	} else {
-		mem_free(buf);
+		if (!insert_left) {
+			mem_free(buf);
+			buf = NULL;
+		}
+
 		insert_will_fit = !new_page_zip
 			&& btr_page_insert_fits(cursor, NULL,
 						NULL, tuple, n_ext, heap);

From 5121205d5753efb69a5dfeb45a1f3c47fd2ada04 Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Jun 2010 21:54:41 +0200
Subject: [PATCH 05/18] Backport into build-201006221614-5.1.46sp1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

> ------------------------------------------------------------
> revno: 3351.47.1
> revision-id: marko.makela@oracle.com-20100511104500-c6kzd0bg5s42p8e9
> parent: vasil.dimov@oracle.com-20100510132852-cz457uqvj8iiy9mm
> committer: Marko Mäkelä <marko.makela@oracle.com>
> branch nick: mysql-5.1-innodb2
> timestamp: Tue 2010-05-11 13:45:00 +0300
> message:
>   Remove a stray expression. Spotted by Sunny Bains.
---
 storage/innodb_plugin/page/page0zip.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/storage/innodb_plugin/page/page0zip.c b/storage/innodb_plugin/page/page0zip.c
index aa5e39ff04a..a64a41ea518 100644
--- a/storage/innodb_plugin/page/page0zip.c
+++ b/storage/innodb_plugin/page/page0zip.c
@@ -571,7 +571,7 @@ page_zip_dir_encode(
 	/* Traverse the list of stored records in the collation order,
 	starting from the first user record. */
 
-	rec = page + PAGE_NEW_INFIMUM, TRUE;
+	rec = page + PAGE_NEW_INFIMUM;
 
 	i = 0;
 

From 0e40579c13aefe908cd3ac249ae17c1d7c13b4b2 Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Jun 2010 21:56:18 +0200
Subject: [PATCH 06/18] Backport into build-201006221614-5.1.46sp1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

> ------------------------------------------------------------
> revno: 3351.47.2
> revision-id: marko.makela@oracle.com-20100511104910-nim8kgguawpis7zo
> parent: marko.makela@oracle.com-20100511104500-c6kzd0bg5s42p8e9
> committer: Marko Mäkelä <marko.makela@oracle.com>
> branch nick: mysql-5.1-innodb2
> timestamp: Tue 2010-05-11 13:49:10 +0300
> message:
>   btr_page_split_and_insert(): Add an assertion
>   suggested by Sunny Bains when reviewing Bug #52964.
---
 storage/innodb_plugin/btr/btr0btr.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/storage/innodb_plugin/btr/btr0btr.c b/storage/innodb_plugin/btr/btr0btr.c
index 1d6b4f5a0e6..0fd209e0216 100644
--- a/storage/innodb_plugin/btr/btr0btr.c
+++ b/storage/innodb_plugin/btr/btr0btr.c
@@ -2004,6 +2004,7 @@ func_start:
 			goto insert_empty;
 		}
 	} else if (UNIV_UNLIKELY(insert_left)) {
+		ut_a(n_iterations > 0);
 		first_rec = page_rec_get_next(page_get_infimum_rec(page));
 		move_limit = page_rec_get_next(btr_cur_get_rec(cursor));
 	} else {

From 8763eab5097231b32a387be03383ae5685d91162 Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Jun 2010 21:59:35 +0200
Subject: [PATCH 07/18] Backport into build-201006221614-5.1.46sp1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

> ------------------------------------------------------------
> revno: 3351.14.47
> revision-id: marko.makela@oracle.com-20100421095033-0acvzxb8um8cms0a
> parent: marko.makela@oracle.com-20100421094032-ir4glqk46qvg2ywn
> committer: Marko Mäkelä <marko.makela@oracle.com>
> branch nick: 5.1-innodb
> timestamp: Wed 2010-04-21 12:50:33 +0300
> message:
>   dtuple_convert_big_rec(): Store locally any fields whose maximum length
>   is less than 256 bytes. (Bug #52745)
>   Add related comments and debug assertions to the "offsets"
>   functions in rem0rec.c.
>   Approved by Sunny Bains
---
 storage/innodb_plugin/data/data0data.c | 15 +++++++
 storage/innodb_plugin/rem/rem0rec.c    | 59 +++++++++++++++++++++++++-
 2 files changed, 72 insertions(+), 2 deletions(-)

diff --git a/storage/innodb_plugin/data/data0data.c b/storage/innodb_plugin/data/data0data.c
index e3c1f1b4f23..0715b49bf9c 100644
--- a/storage/innodb_plugin/data/data0data.c
+++ b/storage/innodb_plugin/data/data0data.c
@@ -666,6 +666,21 @@ dtuple_convert_big_rec(
 				goto skip_field;
 			}
 
+			/* In DYNAMIC and COMPRESSED format, store
+			locally any non-BLOB columns whose maximum
+			length does not exceed 256 bytes.  This is
+			because there is no room for the "external
+			storage" flag when the maximum length is 255
+			bytes or less. This restriction trivially
+			holds in REDUNDANT and COMPACT format, because
+			there we always store locally columns whose
+			length is up to local_len == 788 bytes.
+			@see rec_init_offsets_comp_ordinary */
+			if (ifield->col->mtype != DATA_BLOB
+			    && ifield->col->len < 256) {
+				goto skip_field;
+			}
+
 			longest_i = i;
 			longest = savings;
 
diff --git a/storage/innodb_plugin/rem/rem0rec.c b/storage/innodb_plugin/rem/rem0rec.c
index 27c11dacc8c..59cf6e887d1 100644
--- a/storage/innodb_plugin/rem/rem0rec.c
+++ b/storage/innodb_plugin/rem/rem0rec.c
@@ -212,6 +212,13 @@ rec_get_n_extern_new(
 			const dict_col_t*	col
 				= dict_field_get_col(field);
 			len = *lens--;
+			/* If the maximum length of the field is up
+			to 255 bytes, the actual length is always
+			stored in one byte. If the maximum length is
+			more than 255 bytes, the actual length is
+			stored in one byte for 0..127.  The length
+			will be encoded in two bytes when it is 128 or
+			more, or when the field is stored externally. */
 			if (UNIV_UNLIKELY(col->len > 255)
 			    || UNIV_UNLIKELY(col->mtype == DATA_BLOB)) {
 				if (len & 0x80) {
@@ -294,6 +301,13 @@ rec_init_offsets_comp_ordinary(
 			const dict_col_t*	col
 				= dict_field_get_col(field);
 			len = *lens--;
+			/* If the maximum length of the field is up
+			to 255 bytes, the actual length is always
+			stored in one byte. If the maximum length is
+			more than 255 bytes, the actual length is
+			stored in one byte for 0..127.  The length
+			will be encoded in two bytes when it is 128 or
+			more, or when the field is stored externally. */
 			if (UNIV_UNLIKELY(col->len > 255)
 			    || UNIV_UNLIKELY(col->mtype
 					     == DATA_BLOB)) {
@@ -425,6 +439,15 @@ rec_init_offsets(
 				const dict_col_t*	col
 					= dict_field_get_col(field);
 				len = *lens--;
+				/* If the maximum length of the field
+				is up to 255 bytes, the actual length
+				is always stored in one byte. If the
+				maximum length is more than 255 bytes,
+				the actual length is stored in one
+				byte for 0..127.  The length will be
+				encoded in two bytes when it is 128 or
+				more, or when the field is stored
+				externally. */
 				if (UNIV_UNLIKELY(col->len > 255)
 				    || UNIV_UNLIKELY(col->mtype
 						     == DATA_BLOB)) {
@@ -647,6 +670,13 @@ rec_get_offsets_reverse(
 			const dict_col_t*	col
 				= dict_field_get_col(field);
 			len = *lens++;
+			/* If the maximum length of the field is up
+			to 255 bytes, the actual length is always
+			stored in one byte. If the maximum length is
+			more than 255 bytes, the actual length is
+			stored in one byte for 0..127.  The length
+			will be encoded in two bytes when it is 128 or
+			more, or when the field is stored externally. */
 			if (UNIV_UNLIKELY(col->len > 255)
 			    || UNIV_UNLIKELY(col->mtype == DATA_BLOB)) {
 				if (len & 0x80) {
@@ -781,12 +811,20 @@ rec_get_converted_size_comp_prefix(
 
 		ut_ad(len <= col->len || col->mtype == DATA_BLOB);
 
+		/* If the maximum length of a variable-length field
+		is up to 255 bytes, the actual length is always stored
+		in one byte. If the maximum length is more than 255
+		bytes, the actual length is stored in one byte for
+		0..127.  The length will be encoded in two bytes when
+		it is 128 or more, or when the field is stored externally. */
+
 		if (field->fixed_len) {
 			ut_ad(len == field->fixed_len);
 			/* dict_index_add_col() should guarantee this */
 			ut_ad(!field->prefix_len
 			      || field->fixed_len == field->prefix_len);
 		} else if (dfield_is_ext(&fields[i])) {
+			ut_ad(col->len >= 256 || col->mtype == DATA_BLOB);
 			extra_size += 2;
 		} else if (len < 128
 			   || (col->len < 256 && col->mtype != DATA_BLOB)) {
@@ -1086,6 +1124,8 @@ rec_convert_dtuple_to_rec_comp(
 	/* Store the data and the offsets */
 
 	for (i = 0, field = fields; i < n_fields; i++, field++) {
+		const dict_field_t*	ifield;
+
 		type = dfield_get_type(field);
 		len = dfield_get_len(field);
 
@@ -1120,12 +1160,20 @@ rec_convert_dtuple_to_rec_comp(
 		/* only nullable fields can be null */
 		ut_ad(!dfield_is_null(field));
 
-		fixed_len = dict_index_get_nth_field(index, i)->fixed_len;
-
+		ifield = dict_index_get_nth_field(index, i);
+		fixed_len = ifield->fixed_len;
+		/* If the maximum length of a variable-length field
+		is up to 255 bytes, the actual length is always stored
+		in one byte. If the maximum length is more than 255
+		bytes, the actual length is stored in one byte for
+		0..127.  The length will be encoded in two bytes when
+		it is 128 or more, or when the field is stored externally. */
 		if (fixed_len) {
 			ut_ad(len == fixed_len);
 			ut_ad(!dfield_is_ext(field));
 		} else if (dfield_is_ext(field)) {
+			ut_ad(ifield->col->len >= 256
+			      || ifield->col->mtype == DATA_BLOB);
 			ut_ad(len <= REC_MAX_INDEX_COL_LEN
 			      + BTR_EXTERN_FIELD_REF_SIZE);
 			*lens-- = (byte) (len >> 8) | 0xc0;
@@ -1402,6 +1450,13 @@ rec_copy_prefix_to_buf(
 			prefix_len += field->fixed_len;
 		} else {
 			ulint	len = *lens--;
+			/* If the maximum length of the column is up
+			to 255 bytes, the actual length is always
+			stored in one byte. If the maximum length is
+			more than 255 bytes, the actual length is
+			stored in one byte for 0..127.  The length
+			will be encoded in two bytes when it is 128 or
+			more, or when the column is stored externally. */
 			if (col->len > 255 || col->mtype == DATA_BLOB) {
 				if (len & 0x80) {
 					/* 1exxxxxx */

From 25d938b691c0d6b8261985b2ac4d9e5e2aad4fa9 Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Jun 2010 22:09:31 +0200
Subject: [PATCH 08/18] Backport into 5.1.46sp1:

> revno: 3351.14.56
> committer: Marko Mdkeld <marko.makela@oracle.com>
> branch nick: 5.1-innodb
> timestamp: Mon 2010-04-26 14:08:56 +0300
> message:
>   Add a test case for Bug #52745.
---
 .../innodb_plugin/r/innodb_bug52745.result    | 130 ++++++++++++++++++
 .../innodb_plugin/t/innodb_bug52745.test      | 109 +++++++++++++++
 2 files changed, 239 insertions(+)
 create mode 100644 mysql-test/suite/innodb_plugin/r/innodb_bug52745.result
 create mode 100644 mysql-test/suite/innodb_plugin/t/innodb_bug52745.test

diff --git a/mysql-test/suite/innodb_plugin/r/innodb_bug52745.result b/mysql-test/suite/innodb_plugin/r/innodb_bug52745.result
new file mode 100644
index 00000000000..254c6525257
--- /dev/null
+++ b/mysql-test/suite/innodb_plugin/r/innodb_bug52745.result
@@ -0,0 +1,130 @@
+SET GLOBAL innodb_file_format='Barracuda';
+SET GLOBAL innodb_file_per_table=on;
+CREATE TABLE bug52745 (
+a2 int(10) unsigned DEFAULT NULL,
+col37 time DEFAULT NULL,
+col38 char(229) CHARACTER SET utf8 DEFAULT NULL,
+col39 text,
+col40 timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+col41 int(10) unsigned DEFAULT NULL,
+col42 varchar(248) CHARACTER SET utf8 DEFAULT NULL,
+col43 smallint(5) unsigned zerofill DEFAULT NULL,
+col44 varchar(150) CHARACTER SET utf8 DEFAULT NULL,
+col45 float unsigned zerofill DEFAULT NULL,
+col46 binary(1) DEFAULT NULL,
+col47 tinyint(4) DEFAULT NULL,
+col48 tinyint(1) DEFAULT NULL,
+col49 timestamp NOT NULL DEFAULT '0000-00-00 00:00:00',
+col50 binary(1) DEFAULT NULL,
+col51 double unsigned zerofill DEFAULT NULL,
+col52 int(10) unsigned DEFAULT NULL,
+col53 time DEFAULT NULL,
+col54 double unsigned DEFAULT NULL,
+col55 time DEFAULT NULL,
+col56 mediumtext CHARACTER SET latin2,
+col57 blob,
+col58 decimal(52,16) unsigned zerofill NOT NULL DEFAULT '000000000000000000000000000000000000.0000000000000000',
+col59 binary(1) DEFAULT NULL,
+col60 longblob,
+col61 time DEFAULT NULL,
+col62 longtext CHARACTER SET utf8 COLLATE utf8_persian_ci,
+col63 timestamp NOT NULL DEFAULT '0000-00-00 00:00:00',
+col64 int(10) unsigned DEFAULT NULL,
+col65 date DEFAULT NULL,
+col66 timestamp NOT NULL DEFAULT '0000-00-00 00:00:00',
+col67 binary(1) DEFAULT NULL,
+col68 tinyblob,
+col69 date DEFAULT NULL,
+col70 tinyint(3) unsigned zerofill DEFAULT NULL,
+col71 varchar(44) CHARACTER SET utf8 DEFAULT NULL,
+col72 datetime DEFAULT NULL,
+col73 smallint(5) unsigned zerofill DEFAULT NULL,
+col74 longblob,
+col75 bit(34) DEFAULT NULL,
+col76 float unsigned zerofill DEFAULT NULL,
+col77 year(2) DEFAULT NULL,
+col78 tinyint(3) unsigned DEFAULT NULL,
+col79 set('msfheowh','tbpxbgf','by','wahnrjw','myqfasxz','rsokyumrt') CHARACTER SET latin2 DEFAULT NULL,
+col80 datetime DEFAULT NULL,
+col81 smallint(6) DEFAULT NULL,
+col82 enum('xtaurnqfqz','rifrse','kuzwpbvb','niisabk','zxavro','rbvasv','','uulrfaove','','') DEFAULT NULL,
+col83 bigint(20) unsigned zerofill DEFAULT NULL,
+col84 float unsigned zerofill DEFAULT NULL,
+col85 double DEFAULT NULL,
+col86 enum('ylannv','','vlkhycqc','snke','cxifustp','xiaxaswzp','oxl') CHARACTER SET latin1 COLLATE latin1_german2_ci DEFAULT NULL,
+col87 varbinary(221) DEFAULT NULL,
+col88 double unsigned DEFAULT NULL,
+col89 float unsigned zerofill DEFAULT NULL,
+col90 tinyblob
+) ENGINE=InnoDB DEFAULT CHARSET=latin1 ROW_FORMAT=COMPRESSED KEY_BLOCK_SIZE=1;
+Warnings:
+Note	1291	Column 'col82' has duplicated value '' in ENUM
+Note	1291	Column 'col82' has duplicated value '' in ENUM
+INSERT INTO bug52745 SET
+col40='0000-00-00 00:00:00',
+col51=16547,
+col53='7711484',
+col54=-28604,
+col55='7112612',
+col56='wakefulness\'',
+col57=repeat('absorbefacient\'',106),
+col58=11027,
+col59='AM09gW7',
+col60=repeat('Noelani\'',16),
+col61='2520576',
+col62='substitutiv',
+col63='19950106155112',
+col64=-12038,
+col65='86238806',
+col66='19600719080256',
+col68=repeat('Sagittarius\'',54),
+col69='38943902',
+col70=1232,
+col71='Elora\'',
+col74=repeat('zipp',11),
+col75='0',
+col76=23254,
+col78=13247,
+col79='56219',
+col80='20500609035724',
+col81=11632,
+col82=7,
+col84=-23863,
+col85=6341,
+col87='HZdkf.4 s7t,5Rmq	8so fmr,ruGLUG25TrtI.yQ	2SuHq0ML7rw7.4 b2yf2E5TJxOtBBZImezDnzpj,uPYfznnEUDN1e9aQoO 2DsplB7TFWy	oQJ br  HLF :F,eQ p4i1oWsr lL3PG,hjCz6hYqN h1QTjLCjrv:QCdSzpYBibJAtZCxLOk3l6Blsh.W',
+col88=16894,
+col89=6161,
+col90=repeat('gale',48);
+Warnings:
+Warning	1265	Data truncated for column 'col53' at row 1
+Warning	1264	Out of range value for column 'col54' at row 1
+Warning	1265	Data truncated for column 'col59' at row 1
+Warning	1265	Data truncated for column 'col61' at row 1
+Warning	1264	Out of range value for column 'col64' at row 1
+Warning	1265	Data truncated for column 'col65' at row 1
+Warning	1264	Out of range value for column 'col66' at row 1
+Warning	1265	Data truncated for column 'col68' at row 1
+Warning	1265	Data truncated for column 'col69' at row 1
+Warning	1264	Out of range value for column 'col70' at row 1
+Warning	1264	Out of range value for column 'col78' at row 1
+Warning	1265	Data truncated for column 'col79' at row 1
+Warning	1264	Out of range value for column 'col84' at row 1
+SHOW WARNINGS;
+Level	Code	Message
+Warning	1265	Data truncated for column 'col53' at row 1
+Warning	1264	Out of range value for column 'col54' at row 1
+Warning	1265	Data truncated for column 'col59' at row 1
+Warning	1265	Data truncated for column 'col61' at row 1
+Warning	1264	Out of range value for column 'col64' at row 1
+Warning	1265	Data truncated for column 'col65' at row 1
+Warning	1264	Out of range value for column 'col66' at row 1
+Warning	1265	Data truncated for column 'col68' at row 1
+Warning	1265	Data truncated for column 'col69' at row 1
+Warning	1264	Out of range value for column 'col70' at row 1
+Warning	1264	Out of range value for column 'col78' at row 1
+Warning	1265	Data truncated for column 'col79' at row 1
+Warning	1264	Out of range value for column 'col84' at row 1
+DROP TABLE bug52745;
+SET GLOBAL innodb_file_format=Antelope;
+SET GLOBAL innodb_file_format_check=Antelope;
+SET GLOBAL innodb_file_per_table=0;
diff --git a/mysql-test/suite/innodb_plugin/t/innodb_bug52745.test b/mysql-test/suite/innodb_plugin/t/innodb_bug52745.test
new file mode 100644
index 00000000000..b20a993a2d1
--- /dev/null
+++ b/mysql-test/suite/innodb_plugin/t/innodb_bug52745.test
@@ -0,0 +1,109 @@
+-- source include/have_innodb_plugin.inc
+
+let $file_format=`select @@innodb_file_format`;
+let $file_format_check=`select @@innodb_file_format_check`;
+let $file_per_table=`select @@innodb_file_per_table`;
+SET GLOBAL innodb_file_format='Barracuda';
+SET GLOBAL innodb_file_per_table=on;
+
+CREATE TABLE bug52745 (
+  a2 int(10) unsigned DEFAULT NULL,
+  col37 time DEFAULT NULL,
+  col38 char(229) CHARACTER SET utf8 DEFAULT NULL,
+  col39 text,
+  col40 timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  col41 int(10) unsigned DEFAULT NULL,
+  col42 varchar(248) CHARACTER SET utf8 DEFAULT NULL,
+  col43 smallint(5) unsigned zerofill DEFAULT NULL,
+  col44 varchar(150) CHARACTER SET utf8 DEFAULT NULL,
+  col45 float unsigned zerofill DEFAULT NULL,
+  col46 binary(1) DEFAULT NULL,
+  col47 tinyint(4) DEFAULT NULL,
+  col48 tinyint(1) DEFAULT NULL,
+  col49 timestamp NOT NULL DEFAULT '0000-00-00 00:00:00',
+  col50 binary(1) DEFAULT NULL,
+  col51 double unsigned zerofill DEFAULT NULL,
+  col52 int(10) unsigned DEFAULT NULL,
+  col53 time DEFAULT NULL,
+  col54 double unsigned DEFAULT NULL,
+  col55 time DEFAULT NULL,
+  col56 mediumtext CHARACTER SET latin2,
+  col57 blob,
+  col58 decimal(52,16) unsigned zerofill NOT NULL DEFAULT '000000000000000000000000000000000000.0000000000000000',
+  col59 binary(1) DEFAULT NULL,
+  col60 longblob,
+  col61 time DEFAULT NULL,
+  col62 longtext CHARACTER SET utf8 COLLATE utf8_persian_ci,
+  col63 timestamp NOT NULL DEFAULT '0000-00-00 00:00:00',
+  col64 int(10) unsigned DEFAULT NULL,
+  col65 date DEFAULT NULL,
+  col66 timestamp NOT NULL DEFAULT '0000-00-00 00:00:00',
+  col67 binary(1) DEFAULT NULL,
+  col68 tinyblob,
+  col69 date DEFAULT NULL,
+  col70 tinyint(3) unsigned zerofill DEFAULT NULL,
+  col71 varchar(44) CHARACTER SET utf8 DEFAULT NULL,
+  col72 datetime DEFAULT NULL,
+  col73 smallint(5) unsigned zerofill DEFAULT NULL,
+  col74 longblob,
+  col75 bit(34) DEFAULT NULL,
+  col76 float unsigned zerofill DEFAULT NULL,
+  col77 year(2) DEFAULT NULL,
+  col78 tinyint(3) unsigned DEFAULT NULL,
+  col79 set('msfheowh','tbpxbgf','by','wahnrjw','myqfasxz','rsokyumrt') CHARACTER SET latin2 DEFAULT NULL,
+  col80 datetime DEFAULT NULL,
+  col81 smallint(6) DEFAULT NULL,
+  col82 enum('xtaurnqfqz','rifrse','kuzwpbvb','niisabk','zxavro','rbvasv','','uulrfaove','','') DEFAULT NULL,
+  col83 bigint(20) unsigned zerofill DEFAULT NULL,
+  col84 float unsigned zerofill DEFAULT NULL,
+  col85 double DEFAULT NULL,
+  col86 enum('ylannv','','vlkhycqc','snke','cxifustp','xiaxaswzp','oxl') CHARACTER SET latin1 COLLATE latin1_german2_ci DEFAULT NULL,
+  col87 varbinary(221) DEFAULT NULL,
+  col88 double unsigned DEFAULT NULL,
+  col89 float unsigned zerofill DEFAULT NULL,
+  col90 tinyblob
+) ENGINE=InnoDB DEFAULT CHARSET=latin1 ROW_FORMAT=COMPRESSED KEY_BLOCK_SIZE=1;
+
+INSERT INTO bug52745 SET
+col40='0000-00-00 00:00:00',
+col51=16547,
+col53='7711484',
+col54=-28604,
+col55='7112612',
+col56='wakefulness\'',
+col57=repeat('absorbefacient\'',106),
+col58=11027,
+col59='AM09gW7',
+col60=repeat('Noelani\'',16),
+col61='2520576',
+col62='substitutiv',
+col63='19950106155112',
+col64=-12038,
+col65='86238806',
+col66='19600719080256',
+col68=repeat('Sagittarius\'',54),
+col69='38943902',
+col70=1232,
+col71='Elora\'',
+col74=repeat('zipp',11),
+col75='0',
+col76=23254,
+col78=13247,
+col79='56219',
+col80='20500609035724',
+col81=11632,
+col82=7,
+col84=-23863,
+col85=6341,
+col87='HZdkf.4 s7t,5Rmq	8so fmr,ruGLUG25TrtI.yQ	2SuHq0ML7rw7.4 b2yf2E5TJxOtBBZImezDnzpj,uPYfznnEUDN1e9aQoO 2DsplB7TFWy	oQJ br  HLF :F,eQ p4i1oWsr lL3PG,hjCz6hYqN h1QTjLCjrv:QCdSzpYBibJAtZCxLOk3l6Blsh.W',
+col88=16894,
+col89=6161,
+col90=repeat('gale',48);
+
+SHOW WARNINGS;
+
+DROP TABLE bug52745;
+
+EVAL SET GLOBAL innodb_file_format=$file_format;
+EVAL SET GLOBAL innodb_file_format_check=$file_format_check;
+EVAL SET GLOBAL innodb_file_per_table=$file_per_table;

From 33042e6db5dd86ebb9af6d502ed7b6c069d60a27 Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Jun 2010 22:34:48 +0200
Subject: [PATCH 09/18] Backport into build-201006221614-5.1.46sp1

> ------------------------------------------------------------
> revno: 1810.3987.13
> revision-id: ramil@mysql.com-20100429044232-f0pkyx8fnpszf142
> parent: alexey.kopytov@sun.com-20100426200600-op06qy98llzpzgl1
> committer: Ramil Kalimullin <ramil@mysql.com>
> branch nick: b53237-5.0-bugteam
> timestamp: Thu 2010-04-29 08:42:32 +0400
> message:
>   Fix for bug #53237: mysql_list_fields/COM_FIELD_LIST stack smashing
>
>   Problem: "COM_FIELD_LIST is an old command of the MySQL server, before there was real move to only
>   SQL. Seems that the data sent to COM_FIELD_LIST( mysql_list_fields() function) is not
>   checked for sanity. By sending long data for the table a buffer is overflown, which can
>   be used deliberately to include code that harms".
>
>   Fix: check incoming data length.

The patch did not apply cleanly:
- Line numbers are completely off, roughly it is 2030 -> 1313
- What is called "pend" in the patch, is "arg_end" in the source.
---
 sql/sql_parse.cc | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/sql/sql_parse.cc b/sql/sql_parse.cc
index 5228a37f490..11481933c8a 100644
--- a/sql/sql_parse.cc
+++ b/sql/sql_parse.cc
@@ -1300,8 +1300,16 @@ bool dispatch_command(enum enum_server_command command, THD *thd,
       We have name + wildcard in packet, separated by endzero
     */
     arg_end= strend(packet);
+    uint arg_length= arg_end - packet;
+    
+    /* Check given table name length. */
+    if (arg_length >= packet_length || arg_length > NAME_LEN)
+    {
+      my_message(ER_UNKNOWN_COM_ERROR, ER(ER_UNKNOWN_COM_ERROR), MYF(0));
+      break;
+    }
     thd->convert_string(&conv_name, system_charset_info,
-			packet, (uint) (arg_end - packet), thd->charset());
+			packet, arg_length, thd->charset());
     table_list.alias= table_list.table_name= conv_name.str;
     packet= arg_end + 1;
 

From 74a077b0b67dbf9dd449972e9a3c954de12e8399 Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Jun 2010 22:51:35 +0200
Subject: [PATCH 10/18] Backport into build-201006221614-5.1.46sp1

> ------------------------------------------------------------
> revno: 1810.3987.14
> revision-id: davi.arnaut@sun.com-20100429132816-ictyul6d75itek22
> parent: ramil@mysql.com-20100429044232-f0pkyx8fnpszf142
> committer: Davi Arnaut <Davi.Arnaut@Sun.COM>
> branch nick: 50974-5.0
> timestamp: Thu 2010-04-29 10:28:16 -0300
> message:
>   Bug#50974: Server keeps receiving big (> max_allowed_packet) packets indefinitely.
>
>   The server could be tricked to read packets indefinitely if it
>   received a packet larger than the maximum size of one packet.
>   This problem is aggravated by the fact that it can be triggered
>   before authentication.
>
>   The solution is to no skip big packets for non-authenticated
>   sessions. If a big packet is sent before a session is authen-
>   ticated, a error is returned and the connection is closed.

> ------------------------------------------------------------
> revno: 3363 [merge]
> revision-id: davi.arnaut@sun.com-20100429231819-i3anwzrdasjmezvt
> parent: davi.arnaut@sun.com-20100401131522-895y8uzvv8ag44gs
> parent: davi.arnaut@sun.com-20100429132816-ictyul6d75itek22
> committer: Davi Arnaut <Davi.Arnaut@Sun.COM>
> branch nick: mysql-5.1-bugteam
> timestamp: Thu 2010-04-29 20:18:19 -0300
> message:
>   Manual merge.
> ------------------------------------------------------------
> Use --include-merges or -n0 to see merged revisions.
---
 include/mysql_com.h | 10 ++++++++++
 sql/net_serv.cc     |  4 ++++
 sql/sql_connect.cc  |  7 +++++++
 3 files changed, 21 insertions(+)

diff --git a/include/mysql_com.h b/include/mysql_com.h
index db5a5eb8741..7d3dd3d4f34 100644
--- a/include/mysql_com.h
+++ b/include/mysql_com.h
@@ -277,6 +277,16 @@ typedef struct st_net {
   /** Client library sqlstate buffer. Set along with the error message. */
   char sqlstate[SQLSTATE_LENGTH+1];
   void *extension;
+#if defined(MYSQL_SERVER) && !defined(EMBEDDED_LIBRARY)
+  /*
+    Controls whether a big packet should be skipped.
+
+    Initially set to FALSE by default. Unauthenticated sessions must have
+    this set to FALSE so that the server can't be tricked to read packets
+    indefinitely.
+  */
+  my_bool skip_big_packet;
+#endif
 } NET;
 
 
diff --git a/sql/net_serv.cc b/sql/net_serv.cc
index 73892f31ccf..15c0c581108 100644
--- a/sql/net_serv.cc
+++ b/sql/net_serv.cc
@@ -136,6 +136,9 @@ my_bool my_net_init(NET *net, Vio* vio)
 #else
   net->query_cache_query= 0;
 #endif
+#if defined(MYSQL_SERVER) && !defined(EMBEDDED_LIBRARY)
+  net->skip_big_packet= FALSE;
+#endif
 
   if (vio != 0)					/* If real connection */
   {
@@ -949,6 +952,7 @@ my_real_read(NET *net, size_t *complen)
 	  {
 #if defined(MYSQL_SERVER) && !defined(NO_ALARM)
 	    if (!net->compress &&
+                net->skip_big_packet &&
 		!my_net_skip_rest(net, (uint32) len, &alarmed, &alarm_buff))
 	      net->error= 3;		/* Successfully skiped packet */
 #endif
diff --git a/sql/sql_connect.cc b/sql/sql_connect.cc
index 16f11fe22c4..2039c7f7449 100644
--- a/sql/sql_connect.cc
+++ b/sql/sql_connect.cc
@@ -471,6 +471,13 @@ check_user(THD *thd, enum enum_server_command command,
       }
       my_ok(thd);
       thd->password= test(passwd_len);          // remember for error messages 
+      /*
+        Allow the network layer to skip big packets. Although a malicious
+        authenticated session might use this to trick the server to read
+        big packets indefinitely, this is a previously established behavior
+        that needs to be preserved as to not break backwards compatibility.
+      */
+      thd->net.skip_big_packet= TRUE;
       /* Ready to handle queries */
       DBUG_RETURN(0);
     }

From dacd3e4a77bb4015ca0e2fb55088dbb852f6bd15 Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Jun 2010 22:53:01 +0200
Subject: [PATCH 11/18] Backport into build-201006221614-5.1.46sp1

> ------------------------------------------------------------
> revno: 3351.41.1
> revision-id: alexey.kopytov@sun.com-20100430111048-jdls6ofn4kkmpt09
> parent: sergey.glukhov@sun.com-20100329134249-03wyhzp5k92dzhcb
> committer: Alexey Kopytov <Alexey.Kopytov@Sun.com>
> branch nick: my51-bug48419
> timestamp: Fri 2010-04-30 15:10:48 +0400
> message:
>   Bug #48419: another explain crash..
>
>   WHERE predicates containing references to empty tables in a
>   subquery were handled incorrectly by the optimizer when
>   executing EXPLAIN. As a result, the optimizer could try to
>   evaluate such predicates rather than just stop with
>   "Impossible WHERE noticed after reading const tables" as
>   it would do in a non-subquery case. This led to valgrind
>   errors and crashes.
>
>   Fixed the code checking the above condition so that subqueries
>   are not excluded and hence are handled in the same way as top
>   level SELECTs.
---
 mysql-test/r/explain.result | 12 ++++++++++++
 mysql-test/r/ps.result      | 12 ++++++------
 mysql-test/t/explain.test   | 15 +++++++++++++++
 sql/sql_select.cc           |  3 +--
 4 files changed, 34 insertions(+), 8 deletions(-)

diff --git a/mysql-test/r/explain.result b/mysql-test/r/explain.result
index b8db8b53e06..8f2d704b312 100644
--- a/mysql-test/r/explain.result
+++ b/mysql-test/r/explain.result
@@ -226,4 +226,16 @@ Warnings:
 Note	1276	Field or reference 'test.t1.c' of SELECT #2 was resolved in SELECT #1
 Note	1003	select (select 1 from `test`.`t2` where (`test`.`t2`.`d` = NULL)) AS `(SELECT 1 FROM t2 WHERE d = c)` from `test`.`t1`
 DROP TABLE t1, t2;
+#
+# Bug #48419: another explain crash..
+#
+CREATE TABLE t1 (a INT);
+CREATE TABLE t2 (b BLOB, KEY b(b(100)));
+INSERT INTO t2 VALUES ('1'), ('2'), ('3');
+FLUSH TABLES;
+EXPLAIN SELECT 1 FROM t1 WHERE a = (SELECT 1 FROM t1 t JOIN t2 WHERE b <= 1 AND t.a);
+id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
+1	PRIMARY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
+2	SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
+DROP TABLE t1, t2;
 End of 5.1 tests.
diff --git a/mysql-test/r/ps.result b/mysql-test/r/ps.result
index cf08d763e5c..84b9cdf930c 100644
--- a/mysql-test/r/ps.result
+++ b/mysql-test/r/ps.result
@@ -155,24 +155,24 @@ execute stmt1 ;
 id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 1	PRIMARY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
 6	DERIVED	NULL	NULL	NULL	NULL	NULL	NULL	NULL	no matching row in const table
-5	DEPENDENT SUBQUERY	t2	system	NULL	NULL	NULL	NULL	0	const row not found
-4	DEPENDENT SUBQUERY	t2	system	NULL	NULL	NULL	NULL	0	const row not found
+5	DEPENDENT SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
+4	DEPENDENT SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
 3	DEPENDENT SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
 2	DEPENDENT SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
 execute stmt1 ;
 id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 1	PRIMARY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
 6	DERIVED	NULL	NULL	NULL	NULL	NULL	NULL	NULL	no matching row in const table
-5	DEPENDENT SUBQUERY	t2	system	NULL	NULL	NULL	NULL	0	const row not found
-4	DEPENDENT SUBQUERY	t2	system	NULL	NULL	NULL	NULL	0	const row not found
+5	DEPENDENT SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
+4	DEPENDENT SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
 3	DEPENDENT SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
 2	DEPENDENT SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
 explain SELECT (SELECT SUM(c1 + c12 + 0.0) FROM t2 where (t1.c2 - 0e-3) = t2.c2 GROUP BY t1.c15 LIMIT 1) as scalar_s, exists (select 1.0e+0 from t2 where t2.c3 * 9.0000000000 = t1.c4) as exists_s, c5 * 4 in (select c6 + 0.3e+1 from t2) as in_s, (c7 - 4, c8 - 4) in (select c9 + 4.0, c10 + 40e-1 from t2) as in_row_s FROM t1, (select c25 x, c32 y from t2) tt WHERE x * 1 = c25;
 id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 1	PRIMARY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
 6	DERIVED	NULL	NULL	NULL	NULL	NULL	NULL	NULL	no matching row in const table
-5	DEPENDENT SUBQUERY	t2	system	NULL	NULL	NULL	NULL	0	const row not found
-4	DEPENDENT SUBQUERY	t2	system	NULL	NULL	NULL	NULL	0	const row not found
+5	DEPENDENT SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
+4	DEPENDENT SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
 3	DEPENDENT SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
 2	DEPENDENT SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
 deallocate prepare stmt1;
diff --git a/mysql-test/t/explain.test b/mysql-test/t/explain.test
index 3c2f7bbbe96..ba6be72dbdc 100644
--- a/mysql-test/t/explain.test
+++ b/mysql-test/t/explain.test
@@ -198,4 +198,19 @@ INSERT INTO t2 VALUES (NULL), (0);
 EXPLAIN EXTENDED SELECT (SELECT 1 FROM t2 WHERE d = c) FROM t1;
 DROP TABLE t1, t2;
 
+
+--echo #
+--echo # Bug #48419: another explain crash..
+--echo #
+
+CREATE TABLE t1 (a INT);
+CREATE TABLE t2 (b BLOB, KEY b(b(100)));
+INSERT INTO t2 VALUES ('1'), ('2'), ('3');
+
+FLUSH TABLES;
+
+EXPLAIN SELECT 1 FROM t1 WHERE a = (SELECT 1 FROM t1 t JOIN t2 WHERE b <= 1 AND t.a);
+
+DROP TABLE t1, t2;
+
 --echo End of 5.1 tests.
diff --git a/sql/sql_select.cc b/sql/sql_select.cc
index a426f4b68a1..291432c2bb6 100644
--- a/sql/sql_select.cc
+++ b/sql/sql_select.cc
@@ -1107,8 +1107,7 @@ JOIN::optimize()
   }
 
   if (conds && const_table_map != found_const_table_map &&
-      (select_options & SELECT_DESCRIBE) &&
-      select_lex->master_unit() == &thd->lex->unit) // upper level SELECT
+      (select_options & SELECT_DESCRIBE))
   {
     conds=new Item_int((longlong) 0,1);	// Always false
   }

From d72f61396b0883cd0cc624a33cdfdb9079a070fd Mon Sep 17 00:00:00 2001
From: sunanda <sunanda.menon@sun.com>
Date: Wed, 23 Jun 2010 12:03:22 +0200
Subject: [PATCH 12/18] Backport into build-201006221614-5.1.46sp1

> ------------------------------------------------------------
> revno: 3367 [merge]
> revision-id: joro@sun.com-20100504140328-srxf3c088j2twnq6
> parent: kristofer.pettersson@sun.com-20100503172109-f9hracq5pqsaomb1
> parent: joro@sun.com-20100503151651-nakknn8amrapmdp7
> committer: Georgi Kodinov <joro@sun.com>
> branch nick: B53371-5.1-bugteam
> timestamp: Tue 2010-05-04 17:03:28 +0300
> message:
>   Bug #53371: COM_FIELD_LIST can be abused to bypass table level grants.
>
>   This is the 5.1 merge and extension of the fix.
>   The server was happily accepting paths in table name in all places a table
>   name is accepted (e.g. a SELECT). This allowed all users that have some
>   privilege over some database to read all tables in all databases in all
>   mysql server instances that the server file system has access to.
>   Fixed by :
>   1. making sure no path elements are allowed in quoted table name when
>   constructing the path (note that the path symbols are still valid in table names
>   when they're properly escaped by the server).
>   2. checking the #mysql50# prefixed names the same way they're checked for
>   path elements in mysql-5.0.
> ------------------------------------------------------------
> Use --include-merges or -n0 to see merged revisions.
---
 mysql-test/r/grant.result | 16 ++++++++++++++
 mysql-test/t/grant.test   | 25 ++++++++++++++++++++++
 sql/mysql_priv.h          |  2 +-
 sql/partition_info.cc     |  4 ++--
 sql/sql_parse.cc          |  9 +++++++-
 sql/sql_table.cc          | 14 ++++++++++++
 sql/sql_yacc.yy           |  2 +-
 sql/table.cc              | 29 ++++++++++++++++++++++---
 tests/mysql_client_test.c | 45 +++++++++++++++++++++++++++++++++++++++
 9 files changed, 138 insertions(+), 8 deletions(-)

diff --git a/mysql-test/r/grant.result b/mysql-test/r/grant.result
index 92beccd2a9e..6831ef6183d 100644
--- a/mysql-test/r/grant.result
+++ b/mysql-test/r/grant.result
@@ -1413,3 +1413,19 @@ DROP USER 'user1';
 DROP USER 'user1'@'localhost';
 DROP USER 'user2';
 DROP DATABASE db1;
+CREATE DATABASE db1;
+CREATE DATABASE db2;
+GRANT SELECT ON db1.* to 'testbug'@localhost;
+USE db2;
+CREATE TABLE t1 (a INT);
+USE test;
+SELECT * FROM `../db2/tb2`;
+ERROR 42S02: Table 'db1.../db2/tb2' doesn't exist
+SELECT * FROM `../db2`.tb2;
+ERROR 42000: SELECT command denied to user 'testbug'@'localhost' for table 'tb2'
+SELECT * FROM `#mysql50#/../db2/tb2`;
+ERROR 42S02: Table 'db1.#mysql50#/../db2/tb2' doesn't exist
+DROP USER 'testbug'@localhost;
+DROP TABLE db2.t1;
+DROP DATABASE db1;
+DROP DATABASE db2;
diff --git a/mysql-test/t/grant.test b/mysql-test/t/grant.test
index bcd393bd6ab..cb8d3c63be8 100644
--- a/mysql-test/t/grant.test
+++ b/mysql-test/t/grant.test
@@ -1525,5 +1525,30 @@ DROP USER 'user1'@'localhost';
 DROP USER 'user2';
 DROP DATABASE db1;
 
+
+#
+# Bug #53371: COM_FIELD_LIST can be abused to bypass table level grants.
+#
+
+CREATE DATABASE db1;
+CREATE DATABASE db2;
+GRANT SELECT ON db1.* to 'testbug'@localhost;
+USE db2;
+CREATE TABLE t1 (a INT);
+USE test;
+connect (con1,localhost,testbug,,db1);
+--error ER_NO_SUCH_TABLE
+SELECT * FROM `../db2/tb2`;
+--error ER_TABLEACCESS_DENIED_ERROR
+SELECT * FROM `../db2`.tb2;
+--error ER_NO_SUCH_TABLE
+SELECT * FROM `#mysql50#/../db2/tb2`;
+connection default;
+disconnect con1;
+DROP USER 'testbug'@localhost;
+DROP TABLE db2.t1;
+DROP DATABASE db1;
+DROP DATABASE db2;
+
 # Wait till we reached the initial number of concurrent sessions
 --source include/wait_until_count_sessions.inc
diff --git a/sql/mysql_priv.h b/sql/mysql_priv.h
index 56175d069c5..3ecbef4d456 100644
--- a/sql/mysql_priv.h
+++ b/sql/mysql_priv.h
@@ -2263,7 +2263,7 @@ void update_create_info_from_table(HA_CREATE_INFO *info, TABLE *form);
 int rename_file_ext(const char * from,const char * to,const char * ext);
 bool check_db_name(LEX_STRING *db);
 bool check_column_name(const char *name);
-bool check_table_name(const char *name, uint length);
+bool check_table_name(const char *name, uint length, bool check_for_path_chars);
 char *get_field(MEM_ROOT *mem, Field *field);
 bool get_field(MEM_ROOT *mem, Field *field, class String *res);
 int wild_case_compare(CHARSET_INFO *cs, const char *str,const char *wildstr);
diff --git a/sql/partition_info.cc b/sql/partition_info.cc
index ba9ea0e876e..6e2f7dfad26 100644
--- a/sql/partition_info.cc
+++ b/sql/partition_info.cc
@@ -972,7 +972,7 @@ bool partition_info::check_partition_info(THD *thd, handlerton **eng_type,
           part_elem->engine_type= default_engine_type;
         }
         if (check_table_name(part_elem->partition_name,
-                             strlen(part_elem->partition_name)))
+                             strlen(part_elem->partition_name), FALSE))
         {
           my_error(ER_WRONG_PARTITION_NAME, MYF(0));
           goto end;
@@ -990,7 +990,7 @@ bool partition_info::check_partition_info(THD *thd, handlerton **eng_type,
         {
           sub_elem= sub_it++;
           if (check_table_name(sub_elem->partition_name,
-                               strlen(sub_elem->partition_name)))
+                               strlen(sub_elem->partition_name), FALSE))
           {
             my_error(ER_WRONG_PARTITION_NAME, MYF(0));
             goto end;
diff --git a/sql/sql_parse.cc b/sql/sql_parse.cc
index 11481933c8a..93d80164ffb 100644
--- a/sql/sql_parse.cc
+++ b/sql/sql_parse.cc
@@ -1310,6 +1310,13 @@ bool dispatch_command(enum enum_server_command command, THD *thd,
     }
     thd->convert_string(&conv_name, system_charset_info,
 			packet, arg_length, thd->charset());
+    if (check_table_name(conv_name.str, conv_name.length, FALSE))
+    {
+      /* this is OK due to convert_string() null-terminating the string */
+      my_error(ER_WRONG_TABLE_NAME, MYF(0), conv_name.str);
+      break;
+    }
+
     table_list.alias= table_list.table_name= conv_name.str;
     packet= arg_end + 1;
 
@@ -6233,7 +6240,7 @@ TABLE_LIST *st_select_lex::add_table_to_list(THD *thd,
     DBUG_RETURN(0);				// End of memory
   alias_str= alias ? alias->str : table->table.str;
   if (!test(table_options & TL_OPTION_ALIAS) && 
-      check_table_name(table->table.str, table->table.length))
+      check_table_name(table->table.str, table->table.length, FALSE))
   {
     my_error(ER_WRONG_TABLE_NAME, MYF(0), table->table.str);
     DBUG_RETURN(0);
diff --git a/sql/sql_table.cc b/sql/sql_table.cc
index ad72cab664e..84e6c721d72 100644
--- a/sql/sql_table.cc
+++ b/sql/sql_table.cc
@@ -435,7 +435,21 @@ uint tablename_to_filename(const char *from, char *to, uint to_length)
   DBUG_PRINT("enter", ("from '%s'", from));
 
   if ((length= check_n_cut_mysql50_prefix(from, to, to_length)))
+  {
+    /*
+      Check if the name supplied is a valid mysql 5.0 name and 
+      make the name a zero length string if it's not.
+      Note that just returning zero length is not enough : 
+      a lot of places don't check the return value and expect 
+      a zero terminated string.
+    */  
+    if (check_table_name(to, length, TRUE))
+    {
+      to[0]= 0;
+      length= 0;
+    }
     DBUG_RETURN(length);
+  }
   length= strconvert(system_charset_info, from,
                      &my_charset_filename, to, to_length, &errors);
   if (check_if_legal_tablename(to) &&
diff --git a/sql/sql_yacc.yy b/sql/sql_yacc.yy
index 4f43ab8bebd..f815da006b1 100644
--- a/sql/sql_yacc.yy
+++ b/sql/sql_yacc.yy
@@ -6133,7 +6133,7 @@ alter_list_item:
             {
               MYSQL_YYABORT;
             }
-            if (check_table_name($3->table.str,$3->table.length) ||
+            if (check_table_name($3->table.str,$3->table.length, FALSE) ||
                 ($3->db.str && check_db_name(&$3->db)))
             {
               my_error(ER_WRONG_TABLE_NAME, MYF(0), $3->table.str);
diff --git a/sql/table.cc b/sql/table.cc
index a4e2c59fb87..04d7b3a8d0a 100644
--- a/sql/table.cc
+++ b/sql/table.cc
@@ -494,6 +494,26 @@ inline bool is_system_table_name(const char *name, uint length)
 }
 
 
+/**
+  Check if a string contains path elements
+*/  
+
+static inline bool has_disabled_path_chars(const char *str)
+{
+  for (; *str; str++)
+    switch (*str)
+    {
+      case FN_EXTCHAR:
+      case '/':
+      case '\\':
+      case '~':
+      case '@':
+        return TRUE;
+    }
+  return FALSE;
+}
+
+
 /*
   Read table definition from a binary / text based .frm file
   
@@ -549,7 +569,8 @@ int open_table_def(THD *thd, TABLE_SHARE *share, uint db_flags)
         This kind of tables must have been opened only by the
         my_open() above.
     */
-    if (strchr(share->table_name.str, '@') ||
+    if (has_disabled_path_chars(share->table_name.str) ||
+        has_disabled_path_chars(share->db.str) ||
         !strncmp(share->db.str, MYSQL50_TABLE_NAME_PREFIX,
                  MYSQL50_TABLE_NAME_PREFIX_LENGTH) ||
         !strncmp(share->table_name.str, MYSQL50_TABLE_NAME_PREFIX,
@@ -2711,7 +2732,6 @@ bool check_db_name(LEX_STRING *org_name)
             (name_length > NAME_CHAR_LEN)); /* purecov: inspected */
 }
 
-
 /*
   Allow anything as a table name, as long as it doesn't contain an
   ' ' at the end
@@ -2719,7 +2739,7 @@ bool check_db_name(LEX_STRING *org_name)
 */
 
 
-bool check_table_name(const char *name, uint length)
+bool check_table_name(const char *name, uint length, bool check_for_path_chars)
 {
   uint name_length= 0;  // name length in symbols
   const char *end= name+length;
@@ -2746,6 +2766,9 @@ bool check_table_name(const char *name, uint length)
         continue;
       }
     }
+    if (check_for_path_chars &&
+        (*name == '/' || *name == '\\' || *name == '~' || *name == FN_EXTCHAR))
+      return 1;
 #endif
     name++;
     name_length++;
diff --git a/tests/mysql_client_test.c b/tests/mysql_client_test.c
index f65e549fd96..b99461ecd06 100644
--- a/tests/mysql_client_test.c
+++ b/tests/mysql_client_test.c
@@ -18049,6 +18049,50 @@ static void test_bug44495()
   DBUG_VOID_RETURN;
 }
 
+static void test_bug53371()
+{
+  int rc;
+  MYSQL_RES *result;
+
+  myheader("test_bug53371");
+
+  rc= mysql_query(mysql, "DROP TABLE IF EXISTS t1");
+  myquery(rc);
+  rc= mysql_query(mysql, "DROP DATABASE IF EXISTS bug53371");
+  myquery(rc);
+  rc= mysql_query(mysql, "DROP USER 'testbug'@localhost");
+
+  rc= mysql_query(mysql, "CREATE TABLE t1 (a INT)");
+  myquery(rc);
+  rc= mysql_query(mysql, "CREATE DATABASE bug53371");
+  myquery(rc);
+  rc= mysql_query(mysql, "GRANT SELECT ON bug53371.* to 'testbug'@localhost");
+  myquery(rc);
+
+  rc= mysql_change_user(mysql, "testbug", NULL, "bug53371");
+  myquery(rc);
+
+  rc= mysql_query(mysql, "SHOW COLUMNS FROM client_test_db.t1");
+  DIE_UNLESS(rc);
+  DIE_UNLESS(mysql_errno(mysql) == 1142);
+
+  result= mysql_list_fields(mysql, "../client_test_db/t1", NULL);
+  DIE_IF(result);
+
+  result= mysql_list_fields(mysql, "#mysql50#/../client_test_db/t1", NULL);
+  DIE_IF(result);
+
+  rc= mysql_change_user(mysql, opt_user, opt_password, current_db);
+  myquery(rc);
+  rc= mysql_query(mysql, "DROP TABLE t1");
+  myquery(rc);
+  rc= mysql_query(mysql, "DROP DATABASE bug53371");
+  myquery(rc);
+  rc= mysql_query(mysql, "DROP USER 'testbug'@localhost");
+  myquery(rc);
+}
+
+
 /*
   Read and parse arguments and MySQL options from my.cnf
 */
@@ -18358,6 +18402,7 @@ static struct my_tests_st my_tests[]= {
   { "test_bug30472", test_bug30472 },
   { "test_bug20023", test_bug20023 },
   { "test_bug45010", test_bug45010 },
+  { "test_bug53371", test_bug53371 },
   { "test_bug31418", test_bug31418 },
   { "test_bug31669", test_bug31669 },
   { "test_bug28386", test_bug28386 },

From b722f546b6e4f9f4819910535aae37cb48194823 Mon Sep 17 00:00:00 2001
From: sunanda <sunanda.menon@sun.com>
Date: Wed, 23 Jun 2010 12:14:23 +0200
Subject: [PATCH 13/18] Backport into build-201006221614-5.1.46sp1

> ------------------------------------------------------------
> revno: 3386
> revision-id: sergey.glukhov@sun.com-20100518082821-yajhvbv1ghmlpu1n
> parent: aelkin@mysql.com-20100516170332-x8priwrdjwolc065
> committer: Sergey Glukhov <Sergey.Glukhov@sun.com>
> branch nick: mysql-5.1-bugteam
> timestamp: Tue 2010-05-18 13:28:21 +0500
> message:
>   Bug#48729 SELECT ... FROM INFORMATION_SCHEMA.ROUTINES causes memory to grow
>   Analysis showed that in case of accessing I_S table
>   ROUTINES we perform unnecessary allocations
>   with get_field() function for every processed row that
>   in their turn causes significant memory growth.
>   the fix is to avoid use of get_field().
---
 sql/sql_show.cc | 74 ++++++++++++++++++++++++-------------------------
 1 file changed, 37 insertions(+), 37 deletions(-)

diff --git a/sql/sql_show.cc b/sql/sql_show.cc
index cb60027842d..b4881125b14 100644
--- a/sql/sql_show.cc
+++ b/sql/sql_show.cc
@@ -4180,24 +4180,37 @@ int fill_schema_coll_charset_app(THD *thd, TABLE_LIST *tables, COND *cond)
 }
 
 
+static inline void copy_field_as_string(Field *to_field, Field *from_field)
+{
+  char buff[MAX_FIELD_WIDTH];
+  String tmp_str(buff, sizeof(buff), system_charset_info);
+  from_field->val_str(&tmp_str);
+  to_field->store(tmp_str.ptr(), tmp_str.length(), system_charset_info);
+}
+
+
 bool store_schema_proc(THD *thd, TABLE *table, TABLE *proc_table,
                        const char *wild, bool full_access, const char *sp_user)
 {
-  String tmp_string;
-  String sp_db, sp_name, definer;
   MYSQL_TIME time;
   LEX *lex= thd->lex;
   CHARSET_INFO *cs= system_charset_info;
-  get_field(thd->mem_root, proc_table->field[0], &sp_db);
-  get_field(thd->mem_root, proc_table->field[1], &sp_name);
-  get_field(thd->mem_root, proc_table->field[11], &definer);
+  char sp_db_buff[NAME_LEN + 1], sp_name_buff[NAME_LEN + 1],
+    definer_buff[USERNAME_LENGTH + HOSTNAME_LENGTH + 2];
+  String sp_db(sp_db_buff, sizeof(sp_db_buff), cs);
+  String sp_name(sp_name_buff, sizeof(sp_name_buff), cs);
+  String definer(definer_buff, sizeof(definer_buff), cs);
+
+  proc_table->field[0]->val_str(&sp_db);
+  proc_table->field[1]->val_str(&sp_name);
+  proc_table->field[11]->val_str(&definer);
+
   if (!full_access)
-    full_access= !strcmp(sp_user, definer.ptr());
-  if (!full_access && check_some_routine_access(thd, sp_db.ptr(),
-                                                sp_name.ptr(),
-                                                proc_table->field[2]->
-                                                val_int() ==
-                                                TYPE_ENUM_PROCEDURE))
+    full_access= !strcmp(sp_user, definer.c_ptr_safe());
+  if (!full_access &&
+      check_some_routine_access(thd, sp_db.c_ptr_safe(), sp_name.c_ptr_safe(),
+                                proc_table->field[2]->val_int() ==
+                                TYPE_ENUM_PROCEDURE))
     return 0;
 
   if ((lex->sql_command == SQLCOM_SHOW_STATUS_PROC &&
@@ -4207,55 +4220,42 @@ bool store_schema_proc(THD *thd, TABLE *table, TABLE *proc_table,
       (sql_command_flags[lex->sql_command] & CF_STATUS_COMMAND) == 0)
   {
     restore_record(table, s->default_values);
-    if (!wild || !wild[0] || !wild_compare(sp_name.ptr(), wild, 0))
+    if (!wild || !wild[0] || !wild_compare(sp_name.c_ptr_safe(), wild, 0))
     {
       int enum_idx= (int) proc_table->field[5]->val_int();
       table->field[3]->store(sp_name.ptr(), sp_name.length(), cs);
-      get_field(thd->mem_root, proc_table->field[3], &tmp_string);
-      table->field[0]->store(tmp_string.ptr(), tmp_string.length(), cs);
+      copy_field_as_string(table->field[0], proc_table->field[3]);
       table->field[2]->store(sp_db.ptr(), sp_db.length(), cs);
-      get_field(thd->mem_root, proc_table->field[2], &tmp_string);
-      table->field[4]->store(tmp_string.ptr(), tmp_string.length(), cs);
+      copy_field_as_string(table->field[4], proc_table->field[2]);
       if (proc_table->field[2]->val_int() == TYPE_ENUM_FUNCTION)
       {
-        get_field(thd->mem_root, proc_table->field[9], &tmp_string);
-        table->field[5]->store(tmp_string.ptr(), tmp_string.length(), cs);
+        copy_field_as_string(table->field[5], proc_table->field[9]);
         table->field[5]->set_notnull();
       }
       if (full_access)
       {
-        get_field(thd->mem_root, proc_table->field[19], &tmp_string);
-        table->field[7]->store(tmp_string.ptr(), tmp_string.length(), cs);
+        copy_field_as_string(table->field[7], proc_table->field[19]);
         table->field[7]->set_notnull();
       }
       table->field[6]->store(STRING_WITH_LEN("SQL"), cs);
       table->field[10]->store(STRING_WITH_LEN("SQL"), cs);
-      get_field(thd->mem_root, proc_table->field[6], &tmp_string);
-      table->field[11]->store(tmp_string.ptr(), tmp_string.length(), cs);
+      copy_field_as_string(table->field[11], proc_table->field[6]);
       table->field[12]->store(sp_data_access_name[enum_idx].str, 
                               sp_data_access_name[enum_idx].length , cs);
-      get_field(thd->mem_root, proc_table->field[7], &tmp_string);
-      table->field[14]->store(tmp_string.ptr(), tmp_string.length(), cs);
+      copy_field_as_string(table->field[14], proc_table->field[7]);
+
       bzero((char *)&time, sizeof(time));
       ((Field_timestamp *) proc_table->field[12])->get_time(&time);
       table->field[15]->store_time(&time, MYSQL_TIMESTAMP_DATETIME);
       bzero((char *)&time, sizeof(time));
       ((Field_timestamp *) proc_table->field[13])->get_time(&time);
       table->field[16]->store_time(&time, MYSQL_TIMESTAMP_DATETIME);
-      get_field(thd->mem_root, proc_table->field[14], &tmp_string);
-      table->field[17]->store(tmp_string.ptr(), tmp_string.length(), cs);
-      get_field(thd->mem_root, proc_table->field[15], &tmp_string);
-      table->field[18]->store(tmp_string.ptr(), tmp_string.length(), cs);
+      copy_field_as_string(table->field[17], proc_table->field[14]);
+      copy_field_as_string(table->field[18], proc_table->field[15]);
       table->field[19]->store(definer.ptr(), definer.length(), cs);
-
-      get_field(thd->mem_root, proc_table->field[16], &tmp_string);
-      table->field[20]->store(tmp_string.ptr(), tmp_string.length(), cs);
-
-      get_field(thd->mem_root, proc_table->field[17], &tmp_string);
-      table->field[21]->store(tmp_string.ptr(), tmp_string.length(), cs);
-
-      get_field(thd->mem_root, proc_table->field[18], &tmp_string);
-      table->field[22]->store(tmp_string.ptr(), tmp_string.length(), cs);
+      copy_field_as_string(table->field[20], proc_table->field[16]);
+      copy_field_as_string(table->field[21], proc_table->field[17]);
+      copy_field_as_string(table->field[22], proc_table->field[18]);
 
       return schema_table_store_record(thd, table);
     }

From 120717da681f027fb9c55597fa2753645d90631a Mon Sep 17 00:00:00 2001
From: sunanda <sunanda.menon@sun.com>
Date: Wed, 23 Jun 2010 12:22:05 +0200
Subject: [PATCH 14/18] Backport into build-201006221614-5.1.46sp1

> ------------------------------------------------------------
> revno: 3392.1.1
> revision-id: gshchepa@mysql.com-20100521184732-0jvpzinv0uwyvr2d
> parent: sven.sandberg@sun.com-20100520153801-yyhujm1qqa4eyfn0
> committer: Gleb Shchepa <gshchepa@mysql.com>
> branch nick: 53804-5.1
> timestamp: Fri 2010-05-21 22:47:32 +0400
> message:
>   Bug #53804: serious flaws in the alter database .. upgrade
>               data directory name command
>
>   The check_db_name function has been modified to validate tails of
>   #mysql50#-prefixed database names for compliance with MySQL 5.0
>   database name encoding rules (the check_table_name function call
>   has been reused).
---
 mysql-test/r/renamedb.result |  2 +-
 mysql-test/r/upgrade.result  | 28 ++++++++++++++++++++++++++++
 mysql-test/t/renamedb.test   |  2 +-
 mysql-test/t/upgrade.test    | 34 ++++++++++++++++++++++++++++++++++
 sql/mysql_priv.h             |  1 +
 sql/sql_table.cc             | 23 ++++++++++++++++++++---
 sql/table.cc                 | 34 ++++++++++------------------------
 7 files changed, 95 insertions(+), 29 deletions(-)

diff --git a/mysql-test/r/renamedb.result b/mysql-test/r/renamedb.result
index ff8f89592fc..e77aca0d0b7 100644
--- a/mysql-test/r/renamedb.result
+++ b/mysql-test/r/renamedb.result
@@ -7,6 +7,6 @@ ERROR HY000: Incorrect usage of ALTER DATABASE UPGRADE DATA DIRECTORY NAME and n
 ALTER DATABASE `#mysql51#not-yet` UPGRADE DATA DIRECTORY NAME;
 ERROR HY000: Incorrect usage of ALTER DATABASE UPGRADE DATA DIRECTORY NAME and name
 ALTER DATABASE `#mysql50#` UPGRADE DATA DIRECTORY NAME;
-ERROR HY000: Incorrect usage of ALTER DATABASE UPGRADE DATA DIRECTORY NAME and name
+ERROR 42000: Incorrect database name '#mysql50#'
 ALTER DATABASE `#mysql50#upgrade-me` UPGRADE DATA DIRECTORY NAME;
 ERROR 42000: Unknown database '#mysql50#upgrade-me'
diff --git a/mysql-test/r/upgrade.result b/mysql-test/r/upgrade.result
index 034242079b1..da2f55b5bb1 100644
--- a/mysql-test/r/upgrade.result
+++ b/mysql-test/r/upgrade.result
@@ -112,3 +112,31 @@ select * from `a-b-c`.v1;
 f1
 drop database `a-b-c`;
 use test;
+# End of 5.0 tests
+#
+# Bug #53804: serious flaws in the alter database .. upgrade data
+#             directory name command
+#
+ALTER DATABASE `#mysql50#:` UPGRADE DATA DIRECTORY NAME;
+ERROR 42000: Unknown database '#mysql50#:'
+ALTER DATABASE `#mysql50#.` UPGRADE DATA DIRECTORY NAME;
+ERROR 42000: Incorrect database name '#mysql50#.'
+ALTER DATABASE `#mysql50#../` UPGRADE DATA DIRECTORY NAME;
+ERROR 42000: Incorrect database name '#mysql50#../'
+ALTER DATABASE `#mysql50#../..` UPGRADE DATA DIRECTORY NAME;
+ERROR 42000: Incorrect database name '#mysql50#../..'
+ALTER DATABASE `#mysql50#../../` UPGRADE DATA DIRECTORY NAME;
+ERROR 42000: Incorrect database name '#mysql50#../../'
+ALTER DATABASE `#mysql50#./blablabla` UPGRADE DATA DIRECTORY NAME;
+ERROR 42000: Incorrect database name '#mysql50#./blablabla'
+ALTER DATABASE `#mysql50#../blablabla` UPGRADE DATA DIRECTORY NAME;
+ERROR 42000: Incorrect database name '#mysql50#../blablabla'
+ALTER DATABASE `#mysql50#/` UPGRADE DATA DIRECTORY NAME;
+ERROR 42000: Incorrect database name '#mysql50#/'
+ALTER DATABASE `#mysql50#/.` UPGRADE DATA DIRECTORY NAME;
+ERROR 42000: Incorrect database name '#mysql50#/.'
+USE `#mysql50#.`;
+ERROR 42000: Incorrect database name '#mysql50#.'
+USE `#mysql50#../blablabla`;
+ERROR 42000: Incorrect database name '#mysql50#../blablabla'
+# End of 5.1 tests
diff --git a/mysql-test/t/renamedb.test b/mysql-test/t/renamedb.test
index 84315090b7a..71d0c127058 100644
--- a/mysql-test/t/renamedb.test
+++ b/mysql-test/t/renamedb.test
@@ -44,7 +44,7 @@ ALTER DATABASE `#mysql41#not-supported` UPGRADE DATA DIRECTORY NAME;
 --error ER_WRONG_USAGE
 ALTER DATABASE `#mysql51#not-yet` UPGRADE DATA DIRECTORY NAME;
 
---error ER_WRONG_USAGE
+--error ER_WRONG_DB_NAME
 ALTER DATABASE `#mysql50#` UPGRADE DATA DIRECTORY NAME;
 
 --error ER_BAD_DB_ERROR
diff --git a/mysql-test/t/upgrade.test b/mysql-test/t/upgrade.test
index e390e8a1253..a7b9a1531ff 100644
--- a/mysql-test/t/upgrade.test
+++ b/mysql-test/t/upgrade.test
@@ -137,3 +137,37 @@ select * from `a-b-c`.v1;
 --enable_ps_protocol
 drop database `a-b-c`;
 use test;
+
+--echo # End of 5.0 tests
+
+--echo #
+--echo # Bug #53804: serious flaws in the alter database .. upgrade data
+--echo #             directory name command
+--echo #
+
+--error ER_BAD_DB_ERROR
+ALTER DATABASE `#mysql50#:` UPGRADE DATA DIRECTORY NAME;
+--error ER_WRONG_DB_NAME
+ALTER DATABASE `#mysql50#.` UPGRADE DATA DIRECTORY NAME;
+--error ER_WRONG_DB_NAME
+ALTER DATABASE `#mysql50#../` UPGRADE DATA DIRECTORY NAME;
+--error ER_WRONG_DB_NAME
+ALTER DATABASE `#mysql50#../..` UPGRADE DATA DIRECTORY NAME;
+--error ER_WRONG_DB_NAME
+ALTER DATABASE `#mysql50#../../` UPGRADE DATA DIRECTORY NAME;
+--error ER_WRONG_DB_NAME
+ALTER DATABASE `#mysql50#./blablabla` UPGRADE DATA DIRECTORY NAME;
+--error ER_WRONG_DB_NAME
+ALTER DATABASE `#mysql50#../blablabla` UPGRADE DATA DIRECTORY NAME;
+--error ER_WRONG_DB_NAME
+ALTER DATABASE `#mysql50#/` UPGRADE DATA DIRECTORY NAME;
+--error ER_WRONG_DB_NAME
+ALTER DATABASE `#mysql50#/.` UPGRADE DATA DIRECTORY NAME;
+
+--error ER_WRONG_DB_NAME
+USE `#mysql50#.`;
+--error ER_WRONG_DB_NAME
+USE `#mysql50#../blablabla`;
+
+--echo # End of 5.1 tests
+
diff --git a/sql/mysql_priv.h b/sql/mysql_priv.h
index 3ecbef4d456..30f3a1af437 100644
--- a/sql/mysql_priv.h
+++ b/sql/mysql_priv.h
@@ -2287,6 +2287,7 @@ uint explain_filename(THD* thd, const char *from, char *to, uint to_length,
 uint filename_to_tablename(const char *from, char *to, uint to_length);
 uint tablename_to_filename(const char *from, char *to, uint to_length);
 uint check_n_cut_mysql50_prefix(const char *from, char *to, uint to_length);
+bool check_mysql50_prefix(const char *name);
 #endif /* MYSQL_SERVER || INNODB_COMPATIBILITY_HOOKS */
 #ifdef MYSQL_SERVER
 uint build_table_filename(char *buff, size_t bufflen, const char *db,
diff --git a/sql/sql_table.cc b/sql/sql_table.cc
index 84e6c721d72..babc025db87 100644
--- a/sql/sql_table.cc
+++ b/sql/sql_table.cc
@@ -391,6 +391,25 @@ uint filename_to_tablename(const char *from, char *to, uint to_length)
 }
 
 
+/**
+  Check if given string begins with "#mysql50#" prefix
+  
+  @param   name          string to check cut 
+  
+  @retval
+    FALSE  no prefix found
+  @retval
+    TRUE   prefix found
+*/
+
+bool check_mysql50_prefix(const char *name)
+{
+  return (name[0] == '#' && 
+         !strncmp(name, MYSQL50_TABLE_NAME_PREFIX,
+                  MYSQL50_TABLE_NAME_PREFIX_LENGTH));
+}
+
+
 /**
   Check if given string begins with "#mysql50#" prefix, cut it if so.
   
@@ -406,9 +425,7 @@ uint filename_to_tablename(const char *from, char *to, uint to_length)
 
 uint check_n_cut_mysql50_prefix(const char *from, char *to, uint to_length)
 {
-  if (from[0] == '#' && 
-      !strncmp(from, MYSQL50_TABLE_NAME_PREFIX,
-               MYSQL50_TABLE_NAME_PREFIX_LENGTH))
+  if (check_mysql50_prefix(from))
     return (uint) (strmake(to, from + MYSQL50_TABLE_NAME_PREFIX_LENGTH,
                            to_length - 1) - to);
   return 0;
diff --git a/sql/table.cc b/sql/table.cc
index 04d7b3a8d0a..23d41760495 100644
--- a/sql/table.cc
+++ b/sql/table.cc
@@ -2701,44 +2701,30 @@ bool check_db_name(LEX_STRING *org_name)
 {
   char *name= org_name->str;
   uint name_length= org_name->length;
+  bool check_for_path_chars;
 
   if (!name_length || name_length > NAME_LEN)
     return 1;
 
+  if ((check_for_path_chars= check_mysql50_prefix(name)))
+  {
+    name+= MYSQL50_TABLE_NAME_PREFIX_LENGTH;
+    name_length-= MYSQL50_TABLE_NAME_PREFIX_LENGTH;
+  }
+
   if (lower_case_table_names && name != any_db)
     my_casedn_str(files_charset_info, name);
 
-#if defined(USE_MB) && defined(USE_MB_IDENT)
-  if (use_mb(system_charset_info))
-  {
-    name_length= 0;
-    bool last_char_is_space= TRUE;
-    char *end= name + org_name->length;
-    while (name < end)
-    {
-      int len;
-      last_char_is_space= my_isspace(system_charset_info, *name);
-      len= my_ismbchar(system_charset_info, name, end);
-      if (!len)
-        len= 1;
-      name+= len;
-      name_length++;
-    }
-    return (last_char_is_space || name_length > NAME_CHAR_LEN);
-  }
-  else
-#endif
-    return ((org_name->str[org_name->length - 1] != ' ') ||
-            (name_length > NAME_CHAR_LEN)); /* purecov: inspected */
+  return check_table_name(name, name_length, check_for_path_chars);
 }
 
+
 /*
   Allow anything as a table name, as long as it doesn't contain an
   ' ' at the end
   returns 1 on error
 */
 
-
 bool check_table_name(const char *name, uint length, bool check_for_path_chars)
 {
   uint name_length= 0;  // name length in symbols
@@ -2766,10 +2752,10 @@ bool check_table_name(const char *name, uint length, bool check_for_path_chars)
         continue;
       }
     }
+#endif
     if (check_for_path_chars &&
         (*name == '/' || *name == '\\' || *name == '~' || *name == FN_EXTCHAR))
       return 1;
-#endif
     name++;
     name_length++;
   }

From aff388cd09ff30373cd02c8080911a51bc671817 Mon Sep 17 00:00:00 2001
From: sunanda <sunanda.menon@sun.com>
Date: Wed, 7 Jul 2010 20:34:50 +0200
Subject: [PATCH 15/18] rko Mdkeld change, revision 3351.14.134 add
 innodb_plugin to mysql-test-run default suites was not complete. Bootstrap
 failed to pick up necessary files needed by test and hence all tests failed.

---
 mysql-test/Makefile.am | 1 +
 1 file changed, 1 insertion(+)

diff --git a/mysql-test/Makefile.am b/mysql-test/Makefile.am
index 06aea68b52d..066c8d53c14 100644
--- a/mysql-test/Makefile.am
+++ b/mysql-test/Makefile.am
@@ -100,6 +100,7 @@ TEST_DIRS = t r include std_data std_data/parts collections \
 	suite/rpl_ndb suite/rpl_ndb/t suite/rpl_ndb/r \
 	suite/parts suite/parts/t suite/parts/r suite/parts/inc \
 	suite/innodb suite/innodb/t suite/innodb/r suite/innodb/include \
+	suite/innodb_plugin suite/innodb_plugin/t suite/innodb_plugin/r suite/innodb_plugin/include \
 	suite/engines suite/engines/funcs suite/engines/iuds suite/engines/rr_trx \
 	suite/engines/funcs/r suite/engines/funcs/t suite/engines/iuds/r \
 	suite/engines/iuds/t suite/engines/rr_trx/include suite/engines/rr_trx/r \

From 8349522bde173c1c2306b9edc4073aa9e02827d9 Mon Sep 17 00:00:00 2001
From: "karen.langford@oracle.com" <>
Date: Fri, 9 Jul 2010 14:23:48 +0200
Subject: [PATCH 16/18] Fix bug #55039 Failing assertion: space_id > 0 in
 fil0fil.c.

---
 storage/innodb_plugin/dict/dict0crea.c | 18 +++++++++++++++---
 storage/innodb_plugin/os/os0file.c     | 12 ++++++++++--
 2 files changed, 25 insertions(+), 5 deletions(-)

diff --git a/storage/innodb_plugin/dict/dict0crea.c b/storage/innodb_plugin/dict/dict0crea.c
index f185371bfca..09353c45c8c 100644
--- a/storage/innodb_plugin/dict/dict0crea.c
+++ b/storage/innodb_plugin/dict/dict0crea.c
@@ -240,17 +240,29 @@ dict_build_table_def_step(
 	ibool		is_path;
 	mtr_t		mtr;
 	ulint		space = 0;
+	ibool		file_per_table;
 
 	ut_ad(mutex_own(&(dict_sys->mutex)));
 
 	table = node->table;
 
-	dict_hdr_get_new_id(&table->id, NULL,
-			    srv_file_per_table ? &space : NULL);
+	/* Cache the global variable "srv_file_per_table" to
+	a local variable before using it. Please note
+	"srv_file_per_table" is not under dict_sys mutex
+	protection, and could be changed while executing
+	this function. So better to cache the current value
+	to a local variable, and all future reference to
+	"srv_file_per_table" should use this local variable. */
+	file_per_table = srv_file_per_table;
+
+	dict_hdr_get_new_id(&table->id, NULL, NULL);
 
 	thr_get_trx(thr)->table_id = table->id;
 
-	if (srv_file_per_table) {
+	if (file_per_table) {
+		/* Get a new space id if srv_file_per_table is set */
+		dict_hdr_get_new_id(NULL, NULL, &space);
+
 		if (UNIV_UNLIKELY(space == ULINT_UNDEFINED)) {
 			return(DB_ERROR);
 		}
diff --git a/storage/innodb_plugin/os/os0file.c b/storage/innodb_plugin/os/os0file.c
index b244e3974b3..9f937b9def2 100644
--- a/storage/innodb_plugin/os/os0file.c
+++ b/storage/innodb_plugin/os/os0file.c
@@ -1339,7 +1339,11 @@ try_again:
 
 		/* When srv_file_per_table is on, file creation failure may not
 		be critical to the whole instance. Do not crash the server in
-		case of unknown errors. */
+		case of unknown errors.
+		Please note "srv_file_per_table" is a global variable with
+		no explicit synchronization protection. It could be
+		changed during this execution path. It might not have the
+		same value as the one when building the table definition */
 		if (srv_file_per_table) {
 			retry = os_file_handle_error_no_exit(name,
 						create_mode == OS_FILE_CREATE ?
@@ -1426,7 +1430,11 @@ try_again:
 
 		/* When srv_file_per_table is on, file creation failure may not
 		be critical to the whole instance. Do not crash the server in
-		case of unknown errors. */
+		case of unknown errors.
+		Please note "srv_file_per_table" is a global variable with
+		no explicit synchronization protection. It could be
+		changed during this execution path. It might not have the
+		same value as the one when building the table definition */
 		if (srv_file_per_table) {
 			retry = os_file_handle_error_no_exit(name,
 						create_mode == OS_FILE_CREATE ?

From 32dcc26b33a8516e5957e7c052593e69ec46a4b9 Mon Sep 17 00:00:00 2001
From: Georgi Kodinov <Georgi.Kodinov@Oracle.com>
Date: Mon, 19 Jul 2010 17:47:17 +0300
Subject: [PATCH 17/18] fix tree names

---
 .bzr-mysql/default.conf | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.bzr-mysql/default.conf b/.bzr-mysql/default.conf
index 77df77c6021..f044f8e62da 100644
--- a/.bzr-mysql/default.conf
+++ b/.bzr-mysql/default.conf
@@ -1,4 +1,4 @@
 [MYSQL]
-post_commit_to = "dbg_mysql_security@sun.com"
-post_push_to = "dbg_mysql_security@sun.com"
-tree_name = "mysql-5.1-security"
+post_commit_to = "commits@lists.mysql.com"
+post_push_to = "commits@lists.mysql.com"
+tree_name = "mysql-5.1"

From 17b9155f00f9f80c1c1f15bb98baebe21ac2a9e1 Mon Sep 17 00:00:00 2001
From: Davi Arnaut <davi.arnaut@oracle.com>
Date: Tue, 20 Jul 2010 14:36:15 -0300
Subject: [PATCH 18/18] Bug#54453: Failing assertion: trx->active_trans when
 renaming a            table with active trx

Essentially, the problem is that InnoDB does a implicit commit
when a cursor (table handler) is unlocked/closed, creating
a dissonance between the transaction state within the server
layer and the storage engine layer. Theoretically, a statement
transaction can encompass several table instances in a similar
manner to a multiple statement transaction, hence it does not
make sense to limit a statement transaction to the lifetime of
the table instances (cursors) used within it.

Since this particular instance of the problem is only triggerable
on 5.1 and is masked on 5.5 due 2PC being skipped (assertion is in
the prepare phase of a 2PC), the solution (which is less risky) is
to explicitly end the transaction before the cached table is unlock
on rename table.

The patch is to be null merged into trunk.
---
 mysql-test/include/commit.inc                     |  4 ++--
 mysql-test/r/commit_1innodb.result                |  4 ++--
 .../suite/innodb_plugin/r/innodb_bug54453.result  |  9 +++++++++
 .../suite/innodb_plugin/t/innodb_bug54453.test    | 15 +++++++++++++++
 sql/sql_table.cc                                  |  8 ++++++++
 5 files changed, 36 insertions(+), 4 deletions(-)
 create mode 100644 mysql-test/suite/innodb_plugin/r/innodb_bug54453.result
 create mode 100644 mysql-test/suite/innodb_plugin/t/innodb_bug54453.test

diff --git a/mysql-test/include/commit.inc b/mysql-test/include/commit.inc
index d91ba8291fd..d412eae8364 100644
--- a/mysql-test/include/commit.inc
+++ b/mysql-test/include/commit.inc
@@ -725,9 +725,9 @@ call p_verify_status_increment(4, 4, 4, 4);
 alter table t3 add column (b int);
 call p_verify_status_increment(2, 0, 2, 0);
 alter table t3 rename t4;
-call p_verify_status_increment(2, 2, 2, 2);
+call p_verify_status_increment(1, 0, 1, 0);
 rename table t4 to t3;
-call p_verify_status_increment(2, 2, 2, 2);
+call p_verify_status_increment(1, 0, 1, 0);
 truncate table t3;
 call p_verify_status_increment(4, 4, 4, 4);
 create view v1 as select * from t2;
diff --git a/mysql-test/r/commit_1innodb.result b/mysql-test/r/commit_1innodb.result
index 51c4ac3002c..1f0b2c8019b 100644
--- a/mysql-test/r/commit_1innodb.result
+++ b/mysql-test/r/commit_1innodb.result
@@ -841,11 +841,11 @@ call p_verify_status_increment(2, 0, 2, 0);
 SUCCESS
 
 alter table t3 rename t4;
-call p_verify_status_increment(2, 2, 2, 2);
+call p_verify_status_increment(1, 0, 1, 0);
 SUCCESS
 
 rename table t4 to t3;
-call p_verify_status_increment(2, 2, 2, 2);
+call p_verify_status_increment(1, 0, 1, 0);
 SUCCESS
 
 truncate table t3;
diff --git a/mysql-test/suite/innodb_plugin/r/innodb_bug54453.result b/mysql-test/suite/innodb_plugin/r/innodb_bug54453.result
new file mode 100644
index 00000000000..e623989a9d4
--- /dev/null
+++ b/mysql-test/suite/innodb_plugin/r/innodb_bug54453.result
@@ -0,0 +1,9 @@
+#
+# Bug#54453: Failing assertion: trx->active_trans when renaming a table with active trx
+#
+DROP TABLE IF EXISTS bug54453;
+CREATE TABLE bug54453(a INT) ENGINE=InnoDB;
+ALTER TABLE bug54453 RENAME TO bug54453_2;
+SELECT * FROM bug54453_2;
+a
+DROP TABLE bug54453_2;
diff --git a/mysql-test/suite/innodb_plugin/t/innodb_bug54453.test b/mysql-test/suite/innodb_plugin/t/innodb_bug54453.test
new file mode 100644
index 00000000000..486695d326d
--- /dev/null
+++ b/mysql-test/suite/innodb_plugin/t/innodb_bug54453.test
@@ -0,0 +1,15 @@
+--source include/have_innodb_plugin.inc
+--source include/have_log_bin.inc
+
+--echo #
+--echo # Bug#54453: Failing assertion: trx->active_trans when renaming a table with active trx
+--echo #
+
+--disable_warnings
+DROP TABLE IF EXISTS bug54453;
+--enable_warnings
+
+CREATE TABLE bug54453(a INT) ENGINE=InnoDB;
+ALTER TABLE bug54453 RENAME TO bug54453_2;
+SELECT * FROM bug54453_2;
+DROP TABLE bug54453_2;
diff --git a/sql/sql_table.cc b/sql/sql_table.cc
index 50045ec6d90..47b91fcca0e 100644
--- a/sql/sql_table.cc
+++ b/sql/sql_table.cc
@@ -6848,6 +6848,14 @@ view_err:
     if (!error && (new_name != table_name || new_db != db))
     {
       thd_proc_info(thd, "rename");
+
+      /*
+        Workaround InnoDB ending the transaction when the table instance
+        is unlocked/closed (close_cached_table below), otherwise the trx
+        state will differ between the server and storage engine layers.
+      */
+      ha_autocommit_or_rollback(thd, 0);
+
       /*
         Then do a 'simple' rename of the table. First we need to close all
         instances of 'source' table.