← Back to branch summary

~ubuntu-branches/ubuntu/natty/mysql-5.1/natty-proposed

« back to all changes in this revision

Viewing changes to storage/innobase/row/row0sel.c

  • Committer: Package Import Robot
  • Author(s): Marc Deslauriers
  • Date: 2012-02-22 08:30:45 UTC
  • mfrom: (1.4.1)
  • Revision ID: package-import@ubuntu.com-20120222083045-2rd53r4bnyx7qus4
Tags: 5.1.61-0ubuntu0.11.04.1
https://launchpad.net/bugs/937869
* SECURITY UPDATE: Update to 5.1.61 to fix multiple security issues
  (LP: #937869)
  - http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html
  - CVE-2011-2262
  - CVE-2012-0075
  - CVE-2012-0112
  - CVE-2012-0113
  - CVE-2012-0114
  - CVE-2012-0115
  - CVE-2012-0116
  - CVE-2012-0117
  - CVE-2012-0118
  - CVE-2012-0119
  - CVE-2012-0120
  - CVE-2012-0484
  - CVE-2012-0485
  - CVE-2012-0486
  - CVE-2012-0487
  - CVE-2012-0488
  - CVE-2012-0489
  - CVE-2012-0490
  - CVE-2012-0491
  - CVE-2012-0492
  - CVE-2012-0493
  - CVE-2012-0494
  - CVE-2012-0495
  - CVE-2012-0496

Show diffs side-by-side

added added

removed removed

Lines of Context:
storage/innobase/row/row0sel.c
2468
2468
 
2469
2469
        ut_ad(len != UNIV_SQL_NULL);
2470
2470
        UNIV_MEM_ASSERT_RW(data, len);
 
2471
        UNIV_MEM_ASSERT_W(dest, templ->mysql_col_len);
 
2472
        UNIV_MEM_INVALID(dest, templ->mysql_col_len);
2471
2473
 
2472
2474
        if (templ->type == DATA_INT) {
2473
2475
                /* Convert integer data from Innobase to a little-endian
2502
2504
 
2503
2505
                        dest = row_mysql_store_true_var_len(
2504
2506
                                dest, len, templ->mysql_length_bytes);
 
2507
                        /* Copy the actual data. Leave the rest of the
 
2508
                        buffer uninitialized. */
 
2509
                        ut_memcpy(dest, data, len);
 
2510
                        return;
2505
2511
                }
2506
2512
 
2507
2513
                /* Copy the actual data */
2508
2514
                ut_memcpy(dest, data, len);
2509
2515
 
2510
 
                /* Pad with trailing spaces. We pad with spaces also the
2511
 
                unused end of a >= 5.0.3 true VARCHAR column, just in case
2512
 
                MySQL expects its contents to be deterministic. */
 
2516
                /* Pad with trailing spaces. */
2513
2517
 
2514
2518
                pad_ptr = dest + len;
2515
2519
 
3013
3017
}
3014
3018
 
3015
3019
/************************************************************************
 
3020
Copies a cached field for MySQL from the fetch cache. */
 
3021
static
 
3022
void
 
3023
row_sel_copy_cached_field_for_mysql(
 
3024
/*================================*/
 
3025
        byte*                   buf,    /* in/out: row buffer */
 
3026
        byte*                   cache,  /* in: cached row */
 
3027
        const mysql_row_templ_t*templ)  /* in: column template */
 
3028
{
 
3029
        ulint   len;
 
3030
 
 
3031
        buf += templ->mysql_col_offset;
 
3032
        cache += templ->mysql_col_offset;
 
3033
 
 
3034
        UNIV_MEM_ASSERT_W(buf, templ->mysql_col_len);
 
3035
 
 
3036
        if (templ->mysql_type == DATA_MYSQL_TRUE_VARCHAR
 
3037
            && templ->type != DATA_INT) {
 
3038
                /* Check for != DATA_INT to make sure we do
 
3039
                not treat MySQL ENUM or SET as a true VARCHAR!
 
3040
                Find the actual length of the true VARCHAR field. */
 
3041
                row_mysql_read_true_varchar(
 
3042
                        &len, cache, templ->mysql_length_bytes);
 
3043
                len += templ->mysql_length_bytes;
 
3044
                UNIV_MEM_INVALID(buf, templ->mysql_col_len);
 
3045
        } else {
 
3046
                len = templ->mysql_col_len;
 
3047
        }
 
3048
 
 
3049
        ut_memcpy(buf, cache, len);
 
3050
}
 
3051
 
 
3052
/************************************************************************
3016
3053
Pops a cached row for MySQL from the fetch cache. */
3017
3054
UNIV_INLINE
3018
3055
void
3028
3065
        ut_ad(prebuilt->n_fetch_cached > 0);
3029
3066
        ut_ad(prebuilt->mysql_prefix_len <= prebuilt->mysql_row_len);
3030
3067
 
 
3068
        UNIV_MEM_ASSERT_W(buf, prebuilt->mysql_row_len);
 
3069
 
 
3070
        cached_rec = prebuilt->fetch_cache[prebuilt->fetch_cache_first];
 
3071
 
3031
3072
        if (UNIV_UNLIKELY(prebuilt->keep_other_fields_on_keyread)) {
3032
3073
                /* Copy cache record field by field, don't touch fields that
3033
3074
                are not covered by current key */
3034
 
                cached_rec = prebuilt->fetch_cache[
3035
 
                        prebuilt->fetch_cache_first];
3036
3075
 
3037
3076
                for (i = 0; i < prebuilt->n_template; i++) {
3038
3077
                        templ = prebuilt->mysql_template + i;
3039
 
#if 0 /* Some of the cached_rec may legitimately be uninitialized. */
3040
 
                        UNIV_MEM_ASSERT_RW(cached_rec
3041
 
                                           + templ->mysql_col_offset,
3042
 
                                           templ->mysql_col_len);
3043
 
#endif
3044
 
                        ut_memcpy(buf + templ->mysql_col_offset,
3045
 
                                  cached_rec + templ->mysql_col_offset,
3046
 
                                  templ->mysql_col_len);
 
3078
                        row_sel_copy_cached_field_for_mysql(
 
3079
                                buf, cached_rec, templ);
3047
3080
                        /* Copy NULL bit of the current field from cached_rec
3048
3081
                        to buf */
3049
3082
                        if (templ->mysql_null_bit_mask) {
3053
3086
                                        & (byte)templ->mysql_null_bit_mask;
3054
3087
                        }
3055
3088
                }
3056
 
        }
3057
 
        else {
3058
 
#if 0 /* Some of the cached_rec may legitimately be uninitialized. */
3059
 
                UNIV_MEM_ASSERT_RW(prebuilt->fetch_cache
3060
 
                                   [prebuilt->fetch_cache_first],
3061
 
                                   prebuilt->mysql_prefix_len);
3062
 
#endif
3063
 
                ut_memcpy(buf,
3064
 
                          prebuilt->fetch_cache[prebuilt->fetch_cache_first],
3065
 
                          prebuilt->mysql_prefix_len);
3066
 
        }
 
3089
        } else if (prebuilt->mysql_prefix_len > 63) {
 
3090
                /* The record is long. Copy it field by field, in case
 
3091
                there are some long VARCHAR column of which only a
 
3092
                small length is being used. */
 
3093
                UNIV_MEM_INVALID(buf, prebuilt->mysql_prefix_len);
 
3094
 
 
3095
                /* First copy the NULL bits. */
 
3096
                ut_memcpy(buf, cached_rec, prebuilt->null_bitmap_len);
 
3097
                /* Then copy the requested fields. */
 
3098
 
 
3099
                for (i = 0; i < prebuilt->n_template; i++) {
 
3100
                        row_sel_copy_cached_field_for_mysql(
 
3101
                                buf, cached_rec, prebuilt->mysql_template + i);
 
3102
                }
 
3103
        } else {
 
3104
                ut_memcpy(buf, cached_rec, prebuilt->mysql_prefix_len);
 
3105
        }
 
3106
 
3067
3107
        prebuilt->n_fetch_cached--;
3068
3108
        prebuilt->fetch_cache_first++;
3069
3109