Merge branch '10.6' into bb-10.11-release

Author: sanja-byelkin

debian/autobake-deb.sh

@@ -19,6 +19,9 @@ export DEB_BUILD_OPTIONS="nocheck $DEB_BUILD_OPTIONS"
 # shellcheck source=/dev/null
 source ./VERSION
 
+architecture=$(dpkg-architecture -q DEB_BUILD_ARCH)
+uname_machine=$(uname -m)
+
 # General CI optimizations to keep build output smaller
 if [[ $GITLAB_CI ]]
 then
@@ -82,9 +85,6 @@ remove_package_notes()
   sed -e '/package.notes/d' -i debian/rules debian/control
 }
 
-architecture=$(dpkg-architecture -q DEB_BUILD_ARCH)
-uname_machine=$(uname -m)
-
 # Parse release name and number from Linux standard base release
 # Example:
 #   $ lsb_release -a

mysql-test/main/gis.result

@@ -5577,4 +5577,10 @@ INSERT INTO t1 VALUES (10,'');
 ERROR 22003: Cannot get geometry object from data you send to the GEOMETRY field
 DROP TABLE t1;
 set sql_mode= @orig_sql_mode;
+#
+# MDEV-39481 ASAN error on malformed WKB polygon
+#
+select st_astext(st_geomfromwkb(x'0103000000020000000400000000000000000000000000000000000000000000000000f03f0000000000000000000000000000f03f000000000000f03f0000000000000000000000000000000005000000000000000000e03f000000000000e03f')) 'no asan error here';
+no asan error here
+NULL
 # End of 10.6 tests

mysql-test/main/gis.test

@@ -3558,4 +3558,9 @@ INSERT INTO t1 VALUES (10,'');
 DROP TABLE t1;
 set sql_mode= @orig_sql_mode;
 
+--echo #
+--echo # MDEV-39481 ASAN error on malformed WKB polygon
+--echo #
+select st_astext(st_geomfromwkb(x'0103000000020000000400000000000000000000000000000000000000000000000000f03f0000000000000000000000000000f03f000000000000f03f0000000000000000000000000000000005000000000000000000e03f000000000000e03f')) 'no asan error here';
+
 --echo # End of 10.6 tests

mysql-test/main/outfile.result

@@ -8,12 +8,12 @@
 
 create table t1 (`a` blob);
 insert into t1 values("hello world"),("Hello mars"),(NULL);
-select * into outfile "../../tmp/outfile-test.1" from t1;
-select load_file('../../tmp/outfile-test.1');
-select * into dumpfile "../../tmp/outfile-test.2" from t1 limit 1;
-select load_file('../../tmp/outfile-test.2');
-select * into dumpfile "../../tmp/outfile-test.3" from t1 where a is null;
-select load_file('../../tmp/outfile-test.3');
+eval select * into outfile "../../tmp/outfile-test.1" from t1;
+select load_file(concat(@tmpdir,"/outfile-test.1"));
+eval select * into dumpfile "../../tmp/outfile-test.2" from t1 limit 1;
+select load_file(concat(@tmpdir,"/outfile-test.2"));
+eval select * into dumpfile "../../tmp/outfile-test.3" from t1 where a is null;
+select hex(load_file(concat(@tmpdir,"/outfile-test.3")));
 
 # the following should give errors
 
@@ -85,8 +85,8 @@ create user user_1@localhost;
 grant all on mysqltest.* to user_1@localhost;
 connect (con28181_1,localhost,user_1,,mysqltest);
 
---error ER_ACCESS_DENIED_ERROR
-select schema_name
+--error ER_SPECIFIC_ACCESS_DENIED_ERROR
+eval select schema_name
 into outfile "../../tmp/outfile-test.4"
 fields terminated by ',' optionally enclosed by '"'
  lines terminated by '\n'
@@ -113,5 +113,26 @@ revoke all privileges on *.* from user_1@localhost;
 drop user user_1@localhost;
 drop database mysqltest;
 
+--echo #
+--echo # MDEV-39493 FILE privilege isn't checked for derived
+--echo #
+
+create user u@localhost;
+grant select on *.* to u@localhost;
+connect u,localhost,u;
+--error ER_SPECIFIC_ACCESS_DENIED_ERROR
+evalp select 'hello' into outfile '$MYSQLTEST_VARDIR/tmp/3701920.out';
+--error ER_SPECIFIC_ACCESS_DENIED_ERROR
+evalp select 'hello' into dumpfile '$MYSQLTEST_VARDIR/tmp/3701920.dump';
+--error ER_SPECIFIC_ACCESS_DENIED_ERROR
+evalp select * into outfile '$MYSQLTEST_VARDIR/tmp/3701920.out' from (select 'hello') t;
+--error ER_SPECIFIC_ACCESS_DENIED_ERROR
+evalp select * into dumpfile '$MYSQLTEST_VARDIR/tmp/3701920.dump' from (select 'hello') t;
+disconnect u;
+connection default;
+drop user u@localhost;
+
+--echo # End of 10.6 tests
+
 # Wait till we reached the initial number of concurrent sessions
 --source include/wait_until_count_sessions.inc

mysql-test/main/outfile.test

@@ -12,7 +12,7 @@ select * from t, json_table(t.a, '$' columns(f varchar(20) path '$.foo')) as jt;
 a	f
 {"foo":"bar"}	bar
 select * into outfile 'f' from json_table('[]', '$' columns(x for ordinality)) q;
-ERROR 28000: Access denied for user 'u'@'localhost' (using password: NO)
+ERROR 42000: Access denied; you need (at least one of) the FILE privilege(s) for this operation
 connection default;
 disconnect con1;
 drop user u@localhost;

mysql-test/suite/json/r/json_table_notembedded.result

@@ -18,7 +18,7 @@ select * from t, json_table(t.a, '$' columns(f varchar(20) path '$.foo')) as jt;
 #
 # MDEV-25141 JSON_TABLE: SELECT into outfile bypasses file privilege check
 #
---error ER_ACCESS_DENIED_ERROR
+--error ER_SPECIFIC_ACCESS_DENIED_ERROR
 select * into outfile 'f' from json_table('[]', '$' columns(x for ordinality)) q;
 
 connection default;

mysql-test/suite/json/t/json_table_notembedded.test

@@ -1653,6 +1653,7 @@ uint Gis_polygon::init_from_wkb(const char *wkb, uint len, wkbByteOrder bo,
     if (ls.is_closed(&closed) || !closed)
       return 0;
     wkb+= ls_len;
+    len-= ls_len;
   }
 
   return (uint) (wkb - wkb_orig);

sql/spatial.cc

@@ -4028,15 +4028,13 @@ mysql_execute_command(THD *thd, bool is_called_from_prepared_stmt)
       lex->exchange != NULL implies SELECT .. INTO OUTFILE and this
       requires FILE_ACL access.
     */
-    privilege_t privileges_requested= lex->exchange ? SELECT_ACL | FILE_ACL :
-                                                      SELECT_ACL;
+    if (lex->exchange && (res= check_global_access(thd, FILE_ACL, false)))
+      break;
 
     if (all_tables)
-      res= check_table_access(thd,
-                              privileges_requested,
-                              all_tables, FALSE, UINT_MAX, FALSE);
+      res= check_table_access(thd, SELECT_ACL, all_tables, 0, UINT_MAX, 0);
     else
-      res= check_access(thd, privileges_requested, any_db.str, NULL,NULL,0,0);
+      res= check_access(thd, SELECT_ACL, any_db.str, NULL,NULL, 0, 0);
 
     if (!res)
       res= execute_sqlcom_select(thd, all_tables);

sql/sql_parse.cc

@@ -402,38 +402,46 @@ static bool send_prep_stmt(Prepared_statement *stmt,
 static ulong get_param_length(uchar **packet, ulong len)
 {
   uchar *pos= *packet;
+  ulong length;
+
   if (len < 1)
     return 0;
   if (*pos < 251)
   {
     (*packet)++;
-    return (ulong) *pos;
+    length= *pos;
   }
-  if (len < 3)
-    return 0;
-  if (*pos == 252)
+  else if (*pos == 252)
   {
+    if (len < 3)
+      return 0;
     (*packet)+=3;
-    return (ulong) uint2korr(pos+1);
+    length= uint2korr(pos+1);
   }
-  if (len < 4)
-    return 0;
-  if (*pos == 253)
+  else if (*pos == 253)
   {
+    if (len < 4)
+      return 0;
     (*packet)+=4;
-    return (ulong) uint3korr(pos+1);
+    length= uint3korr(pos+1);
+  }
+  else
+  {
+    if (len < 9)
+      return 0;
+    (*packet)+=9; // Must be 254 when here
+    /*
+      In our client-server protocol all numbers bigger than 2^24
+      stored as 8 bytes with uint8korr. Here we always know that
+      parameter length is less than 2^32 so don't look at the second
+      4 bytes. But still we need to obey the protocol hence 9 in the
+      assignment above.
+    */
+    length= uint4korr(pos+1);
   }
-  if (len < 5)
+  if (pos + len < *packet + length)
     return 0;
-  (*packet)+=9; // Must be 254 when here
-  /*
-    In our client-server protocol all numbers bigger than 2^24
-    stored as 8 bytes with uint8korr. Here we always know that
-    parameter length is less than 2^4 so don't look at the second
-    4 bytes. But still we need to obey the protocol hence 9 in the
-    assignment above.
-  */
-  return (ulong) uint4korr(pos+1);
+  return length;
 }
 #else
 #define get_param_length(packet, len) len
@@ -648,7 +656,12 @@ void Item_param::set_param_date(uchar **pos, ulong len)
 */
 void Item_param::set_param_time(uchar **pos, ulong len)
 {
-  MYSQL_TIME tm= *((MYSQL_TIME*)*pos);
+  MYSQL_TIME tm;
+  if (len >= sizeof (MYSQL_TIME))
+    tm= *((MYSQL_TIME*)*pos);
+  else
+    set_zero_time(&tm, MYSQL_TIMESTAMP_TIME);
+
   tm.hour+= tm.day * 24;
   tm.day= tm.year= tm.month= 0;
   if (tm.hour > 838)
@@ -663,15 +676,23 @@ void Item_param::set_param_time(uchar **pos, ulong len)
 
 void Item_param::set_param_datetime(uchar **pos, ulong len)
 {
-  MYSQL_TIME tm= *((MYSQL_TIME*)*pos);
+  MYSQL_TIME tm;
+  if (len >= sizeof (MYSQL_TIME))
+    tm= *((MYSQL_TIME*)*pos);
+  else
+    set_zero_time(&tm, MYSQL_TIMESTAMP_DATETIME);
   tm.neg= 0;
   set_time(&tm, MYSQL_TIMESTAMP_DATETIME, MAX_DATETIME_WIDTH);
 }
 
 void Item_param::set_param_date(uchar **pos, ulong len)
 {
-  MYSQL_TIME *to= (MYSQL_TIME*)*pos;
-  set_time(to, MYSQL_TIMESTAMP_DATE, MAX_DATE_WIDTH);
+  MYSQL_TIME tm;
+  if (len >= sizeof (MYSQL_TIME))
+    tm= *((MYSQL_TIME*)*pos);
+  else
+    set_zero_time(&tm, MYSQL_TIMESTAMP_DATE);
+  set_time(&tm, MYSQL_TIMESTAMP_DATE, MAX_DATE_WIDTH);
 }
 #endif /*!EMBEDDED_LIBRARY*/
 
@@ -683,8 +704,6 @@ void Item_param::set_param_str(uchar **pos, ulong len)
     set_null();
   else
   {
-    if (length > len)
-      length= len;
     /*
       We use &my_charset_bin here. Conversion and setting real character
       sets will be done in Item_param::convert_str_value(), after the
@@ -1610,13 +1629,15 @@ static int mysql_test_select(Prepared_statement *stmt,
 
   lex->first_select_lex()->context.resolve_in_select_list= TRUE;
 
-  privilege_t privilege(lex->exchange ? SELECT_ACL | FILE_ACL : SELECT_ACL);
+  if (lex->exchange && check_global_access(thd, FILE_ACL, false))
+    goto error;
+
   if (tables)
   {
-    if (check_table_access(thd, privilege, tables, FALSE, UINT_MAX, FALSE))
+    if (check_table_access(thd, SELECT_ACL, tables, FALSE, UINT_MAX, FALSE))
       goto error;
   }
-  else if (check_access(thd, privilege, any_db.str, NULL, NULL, 0, 0))
+  else if (check_access(thd, SELECT_ACL, any_db.str, NULL, NULL, 0, 0))
     goto error;
 
   if (!lex->result && !(lex->result= new (stmt->mem_root) select_send(thd)))