1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148
|
#! /bin/sh /usr/share/dpatch/dpatch-run
## 46_CVE-2007-1420_subselect_dos.dpatch by <seanius@debian.org>
##
## All lines beginning with `## DP:' are a description of the patch.
## DP: No description.
@DPATCH@
diff -urNad mysql-dfsg-5.0-5.0.32~/sql/mysql_priv.h mysql-dfsg-5.0-5.0.32/sql/mysql_priv.h
--- mysql-dfsg-5.0-5.0.32~/sql/mysql_priv.h 2006-12-20 12:14:48.000000000 +0100
+++ mysql-dfsg-5.0-5.0.32/sql/mysql_priv.h 2007-03-14 20:13:29.000000000 +0100
@@ -928,7 +928,8 @@
int fill_schema_schema_privileges(THD *thd, TABLE_LIST *tables, COND *cond);
int fill_schema_table_privileges(THD *thd, TABLE_LIST *tables, COND *cond);
int fill_schema_column_privileges(THD *thd, TABLE_LIST *tables, COND *cond);
-bool get_schema_tables_result(JOIN *join);
+bool get_schema_tables_result(JOIN *join,
+ enum enum_schema_table_state executed_place);
#define is_schema_db(X) \
!my_strcasecmp(system_charset_info, information_schema_name.str, (X))
diff -urNad mysql-dfsg-5.0-5.0.32~/sql/sql_select.cc mysql-dfsg-5.0-5.0.32/sql/sql_select.cc
--- mysql-dfsg-5.0-5.0.32~/sql/sql_select.cc 2006-12-20 12:14:03.000000000 +0100
+++ mysql-dfsg-5.0-5.0.32/sql/sql_select.cc 2007-03-14 20:13:29.000000000 +0100
@@ -1472,7 +1472,7 @@
if ((curr_join->select_lex->options & OPTION_SCHEMA_TABLE) &&
!thd->lex->describe &&
- get_schema_tables_result(curr_join))
+ get_schema_tables_result(curr_join, PROCESSED_BY_JOIN_EXEC))
{
DBUG_VOID_RETURN;
}
@@ -12278,7 +12278,7 @@
/* Fill schema tables with data before filesort if it's necessary */
if ((join->select_lex->options & OPTION_SCHEMA_TABLE) &&
!thd->lex->describe &&
- get_schema_tables_result(join))
+ get_schema_tables_result(join, PROCESSED_BY_CREATE_SORT_INDEX))
goto err;
if (table->s->tmp_table)
diff -urNad mysql-dfsg-5.0-5.0.32~/sql/sql_show.cc mysql-dfsg-5.0-5.0.32/sql/sql_show.cc
--- mysql-dfsg-5.0-5.0.32~/sql/sql_show.cc 2006-12-20 12:14:31.000000000 +0100
+++ mysql-dfsg-5.0-5.0.32/sql/sql_show.cc 2007-03-14 20:13:29.000000000 +0100
@@ -3939,13 +3939,15 @@
SYNOPSIS
get_schema_tables_result()
join join which use schema tables
+ executed_place place where I_S table processed
RETURN
FALSE success
TRUE error
*/
-bool get_schema_tables_result(JOIN *join)
+bool get_schema_tables_result(JOIN *join,
+ enum enum_schema_table_state executed_place)
{
JOIN_TAB *tmp_join_tab= join->join_tab+join->tables;
THD *thd= join->thd;
@@ -3965,14 +3967,24 @@
bool is_subselect= (&lex->unit != lex->current_select->master_unit() &&
lex->current_select->master_unit()->item);
/*
- The schema table is already processed and
- the statement is not a subselect.
- So we don't need to handle this table again.
+ If schema table is already processed and
+ the statement is not a subselect then
+ we don't need to fill this table again.
+ If schema table is already processed and
+ schema_table_state != executed_place then
+ table is already processed and
+ we should skip second data processing.
*/
- if (table_list->is_schema_table_processed && !is_subselect)
+ if (table_list->schema_table_state &&
+ (!is_subselect || table_list->schema_table_state != executed_place))
continue;
- if (is_subselect) // is subselect
+ /*
+ if table is used in a subselect and
+ table has been processed earlier with the same
+ 'executed_place' value then we should refresh the table.
+ */
+ if (table_list->schema_table_state && is_subselect)
{
table_list->table->file->extra(HA_EXTRA_RESET_STATE);
table_list->table->file->delete_all_rows();
@@ -3988,10 +4000,10 @@
{
result= 1;
join->error= 1;
- table_list->is_schema_table_processed= TRUE;
+ table_list->schema_table_state= executed_place;
break;
}
- table_list->is_schema_table_processed= TRUE;
+ table_list->schema_table_state= executed_place;
}
}
thd->no_warnings_for_error= 0;
diff -urNad mysql-dfsg-5.0-5.0.32~/sql/table.cc mysql-dfsg-5.0-5.0.32/sql/table.cc
--- mysql-dfsg-5.0-5.0.32~/sql/table.cc 2006-12-20 12:14:17.000000000 +0100
+++ mysql-dfsg-5.0-5.0.32/sql/table.cc 2007-03-14 20:13:29.000000000 +0100
@@ -3029,7 +3029,7 @@
*/
table= 0;
/* Reset is_schema_table_processed value(needed for I_S tables */
- is_schema_table_processed= FALSE;
+ schema_table_state= NOT_PROCESSED;
TABLE_LIST *embedded; /* The table at the current level of nesting. */
TABLE_LIST *embedding= this; /* The parent nested table reference. */
diff -urNad mysql-dfsg-5.0-5.0.32~/sql/table.h mysql-dfsg-5.0-5.0.32/sql/table.h
--- mysql-dfsg-5.0-5.0.32~/sql/table.h 2006-12-20 12:14:27.000000000 +0100
+++ mysql-dfsg-5.0-5.0.32/sql/table.h 2007-03-14 20:13:29.000000000 +0100
@@ -288,6 +288,12 @@
void reset_item_list(List<Item> *item_list) const;
};
+enum enum_schema_table_state
+{
+ NOT_PROCESSED= 0,
+ PROCESSED_BY_CREATE_SORT_INDEX,
+ PROCESSED_BY_JOIN_EXEC
+};
typedef struct st_foreign_key_info
{
@@ -530,7 +536,6 @@
st_select_lex_unit *derived; /* SELECT_LEX_UNIT of derived table */
ST_SCHEMA_TABLE *schema_table; /* Information_schema table */
st_select_lex *schema_select_lex;
- bool is_schema_table_processed;
/*
True when the view field translation table is used to convert
schema table fields for backwards compatibility with SHOW command.
@@ -639,6 +644,7 @@
*/
bool prelocking_placeholder;
+ enum enum_schema_table_state schema_table_state;
void calc_md5(char *buffer);
void set_underlying_merge();
int view_check_option(THD *thd, bool ignore_failure);
|