bk commit into 4.0 tree (evgen:1.2172) BUG#16510

[eugene]

Below is the list of changes that have just been committed into a local
4.0 repository of evgen. When evgen does a push these changes will
be propagated to the main repository and, within 24 hours after the
push, to the public repository.
For information on how to access the public repository
see http://dev.mysql.com/doc/mysql/en/installing-source-tree.html

ChangeSet
  1.2172 06/01/23 21:51:32 evgen@stripped +3 -0
  Fixed bug #16510: Updating field named like '*name' caused server crash.
  
  When setup_fields() function finds field named '*' it expands it to the list
  of all table fields. It does so by checking that the first char of
  field_name is '*', but it doesn't checks that the '* is the only char.
  Due to this, when updating table with a field named like '*name', such field
  is wrongly treated as '*' and expanded. This leads to making list of fields
  to update being longer than list of the new values. Later, the fill_record() 
  function crashes by dereferencing null when there is left fields to update,
  but no more values.
  
  Added check in the setup_fields() function which ensures that the field
  expanding will be done only when '*' is the only char in the field name.

  sql/sql_base.cc
    1.194 06/01/23 21:50:25 evgen@stripped +1 -0
    Fixed bug #16510: Updating field named like '*name' caused server crash.
    Added check in the setup_fields() function which ensures that the field
    expanding will be done only when '*' is the only char in the field name.

  mysql-test/r/update.result
    1.18 06/01/23 21:47:18 evgen@stripped +4 -0
    Added test case for bug#16510: Updating field named like '*name' caused server crash

  mysql-test/t/update.test
    1.16 06/01/23 21:46:48 evgen@stripped +8 -0
    Added test case for bug#16510: Updating field named like '*name' caused server crash

# This is a BitKeeper patch.  What follows are the unified diffs for the
# set of deltas contained in the patch.  The rest of the patch, the part
# that BitKeeper cares about, is below these diffs.
# User:	evgen
# Host:	moonbone.local
# Root:	/work/16510-bug-4.0-mysql

--- 1.193/sql/sql_base.cc	2005-11-03 20:24:00 +03:00
+++ 1.194/sql/sql_base.cc	2006-01-23 21:50:25 +03:00
@@ -1983,6 +1983,7 @@
     */
     if (item->type() == Item::FIELD_ITEM &&
 	((Item_field*) item)->field_name[0] == '*' &&
+        ((Item_field*) item)->field_name[1] == 0 &&
 	!((Item_field*) item)->field)
     {
       uint elem=fields.elements;

--- 1.17/mysql-test/r/update.result	2005-03-17 09:24:48 +03:00
+++ 1.18/mysql-test/r/update.result	2006-01-23 21:47:18 +03:00
@@ -216,3 +216,7 @@
 a	b
 0	2
 drop table t1;
+create table t1(f1 int, `*f2` int);
+insert into t1 values (1,1);
+update t1 set `*f2`=1;
+drop table t1;

--- 1.15/mysql-test/t/update.test	2005-03-17 09:24:48 +03:00
+++ 1.16/mysql-test/t/update.test	2006-01-23 21:46:48 +03:00
@@ -174,3 +174,11 @@
 update t1 set b = b + 1 where a = 0;
 select * from t1;
 drop table t1;
+
+#
+# Bug #16510 Updating field named like '*name' caused server crash
+#
+create table t1(f1 int, `*f2` int);
+insert into t1 values (1,1);
+update t1 set `*f2`=1;
+drop table t1;