~ubuntu-branches/ubuntu/lucid/mysql-dfsg-5.1/lucid-security

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
# the file to be sourced from binlog.binlog_mix_innodb_myisam

#
# Bug #27417  	thd->no_trans_update.stmt lost value inside of SF-exec-stack
# bug #28960    non-trans temp table changes with insert .. select
#               not binlogged after rollback
#
# testing appearence of insert into temp_table in binlog.
# There are two branches of execution that require different setup.

# checking binlog content filled with row-based events due to
# a used stored function modifies non-transactional table

## send_eof() branch

# prepare

create temporary table tt (a int unique);
create table ti (a int) engine=innodb;
reset master;

# action

begin; 
insert into ti values (1); 
insert into ti values (2) ; 
insert into tt select * from ti;
rollback;

# check

select count(*) from tt /* 2 */;
source include/show_binlog_events.inc;
select count(*) from ti /* zero */;
insert into ti select * from tt;
select * from ti /* that is what slave would miss - bug#28960 */;


## send_error() branch
delete from ti;
delete from tt where a=1;
reset master;

# action

begin; 
insert into ti values (1); 
insert into ti values (2) /* to make the dup error in the following */; 
--error ER_DUP_ENTRY
insert into tt select * from ti /* one affected and error */;
rollback;

# check

source include/show_binlog_events.inc; # nothing in binlog with row bilog format
select count(*) from ti /* zero */;
insert into ti select * from tt;
select * from tt /* that is what otherwise slave missed - the bug */;

drop table ti;


#
# Bug #27417 thd->no_trans_update.stmt lost value inside of SF-exec-stack
#
# Testing asserts: if there is a side effect of modifying non-transactional
# table thd->no_trans_update.stmt must be TRUE;
# the assert is active with debug build
#

--disable_warnings
drop function if exists bug27417;
drop table if exists t1,t2;
--enable_warnings
# side effect table
CREATE TABLE t1 (a int NOT NULL auto_increment primary key) ENGINE=MyISAM;
# target tables
CREATE TABLE t2 (a int NOT NULL auto_increment, PRIMARY KEY (a));

delimiter |;
create function bug27417(n int) 
RETURNS int(11)
begin
  insert into t1 values (null);
  return n;
end|
delimiter ;|

reset master;

# execute

insert into t2 values (bug27417(1));
insert into t2 select bug27417(2);
reset master;

--error ER_DUP_ENTRY
insert into t2 values (bug27417(2));
source include/show_binlog_events.inc; #only (!) with fixes for #23333 will show there is the query
select count(*) from t1 /* must be 3 */;

reset master;
select count(*) from t2;
delete from t2 where a=bug27417(3);
select count(*) from t2 /* nothing got deleted */; 
source include/show_binlog_events.inc; # the query must be in regardless of #23333
select count(*) from t1 /* must be 5 */;

--enable_info
delete t2 from t2 where t2.a=bug27417(100) /* must not affect t2 */;
--disable_info
select count(*) from t1 /* must be 7 */;

# function bug27417 remains for the following testing of bug#23333
drop table t1,t2;

#
# Bug#23333 using the patch (and the test) for bug#27471
# throughout the bug tests 
# t1 - non-trans side effects gatherer;
# t2 - transactional table;
#
CREATE TABLE t1 (a int  NOT NULL auto_increment primary key) ENGINE=MyISAM;
CREATE TABLE t2 (a int, PRIMARY KEY (a)) ENGINE=InnoDB;
CREATE TABLE t3 (a int, PRIMARY KEY (a), b int unique) ENGINE=MyISAM;
CREATE TABLE t4 (a int, PRIMARY KEY (a), b int unique) ENGINE=Innodb;
CREATE TABLE t5 (a int, PRIMARY KEY (a)) ENGINE=InnoDB;


#
# INSERT
#

# prepare
  
 insert into t2 values (1);
 reset master;

# execute

 --error ER_DUP_ENTRY
 insert into t2 values (bug27417(1)); 
  
# check

 source include/show_binlog_events.inc; # must be event of the query
 select count(*) from t1 /* must be 1 */;

#
# INSERT SELECT
#

# prepare
 delete from t1;
 delete from t2;
 insert into t2 values (2);
 reset master;

# execute

 --error ER_DUP_ENTRY
 insert into t2 select bug27417(1) union select bug27417(2); 
  
# check

 source include/show_binlog_events.inc; # must be events of the query
 select count(*) from t1 /* must be 2 */;

#
# UPDATE inc multi-update
#

# prepare
 delete from t1;
 insert into t3 values (1,1),(2,3),(3,4);
 reset master;

# execute
 --error ER_DUP_ENTRY
 update t3 set b=b+bug27417(1);

# check
 source include/show_binlog_events.inc; # must be events of the query
 select count(*) from t1 /* must be 2 */;

## multi_update::send_eof() branch

# prepare
 delete from t3;
 delete from t4;
 insert into t3 values (1,1);
 insert into t4 values (1,1),(2,2);

 reset master;

# execute
 --error ER_DUP_ENTRY
 UPDATE t4,t3 SET t4.a=t3.a + bug27417(1) /* top level non-ta table */;

# check
 source include/show_binlog_events.inc; # the offset must denote there is the query
 select count(*) from t1 /* must be 4 */;

## send_error() branch of multi_update

# prepare
 delete from t1;
 delete from t3;
 delete from t4;
 insert into t3 values (1,1),(2,2);
 insert into t4 values (1,1),(2,2);

 reset master;

# execute
 --error ER_DUP_ENTRY
 UPDATE t3,t4 SET t3.a = t4.a + bug27417(1) where t3.a = 1;

# check
 select count(*) from t1 /* must be 1 */;

# cleanup
 drop table t4;


#
# DELETE incl multi-delete
#

# prepare
 delete from t1;
 delete from t2;
 delete from t3;
 insert into t2 values (1);
 insert into t3 values (1,1);
 create trigger trg_del before delete on t2 for each row 
   insert into t3 values (bug27417(1), 2);
 reset master;

# execute
 --error ER_DUP_ENTRY
 delete from t2;
# check
 source include/show_binlog_events.inc; # the offset must denote there is the query
 select count(*) from t1 /* must be 1 */;

# cleanup
 drop trigger trg_del;

# prepare
 delete from t1;
 delete from t2;
 delete from t5;
 create trigger trg_del_t2 after  delete on t2 for each row
   insert into t1 values (1);
 insert into t2 values (2),(3);
 insert into t5 values (1),(2);
 reset master;

# execute
 --error ER_DUP_ENTRY
 delete t2.* from t2,t5 where t2.a=t5.a + 1;

# check
 source include/show_binlog_events.inc; # must be events of the query
 select count(*) from t1 /* must be 1 */;


#
# LOAD DATA
#

# prepare
 delete from t1;
 create table t4 (a int default 0, b int primary key) engine=innodb;
 insert into t4 values (0, 17);
 reset master;

# execute
 --error ER_DUP_ENTRY
 load data infile '../../std_data/rpl_loaddata.dat' into table t4 (a, @b) set b= @b + bug27417(2);
# check
 select * from t4;
 select count(*) from t1 /* must be 2 */;
 source include/show_binlog_events.inc; # must be events of the query

#
# bug#23333 cleanup
#


drop trigger trg_del_t2;
drop table t1,t2,t3,t4,t5;
drop function bug27417;