bk commit into 5.1 tree (bar:1.2574) BUG#27898

[bar]

Below is the list of changes that have just been committed into a local
5.1 repository of bar. When bar does a push these changes will
be propagated to the main repository and, within 24 hours after the
push, to the public repository.
For information on how to access the public repository
see http://dev.mysql.com/doc/mysql/en/installing-source-tree.html

ChangeSet
  1.2574 07/05/02 13:18:07 bar@stripped +3 -0
  Bug#27898 UPDATEXML Crashes the Server!
  Problem: when replacing the root element, UpdateXML
  erroneously tried to mix old XML content with the
  replacement string, which led to crash.
  Fix: don't use the old XML content in these cases,
  just return the replacement string.

  sql/item_xmlfunc.cc
    1.27 07/05/02 13:18:03 bar@stripped +10 -0
    Adding special code to handle replacements of the root element -
    the replacing content is just copied to the result,
    the previous content of the XML value is removed.

  mysql-test/t/xml.test
    1.20 07/05/02 13:18:03 bar@stripped +7 -0
    Adding test case

  mysql-test/r/xml.result
    1.22 07/05/02 13:18:03 bar@stripped +7 -0
    Adding test case

# This is a BitKeeper patch.  What follows are the unified diffs for the
# set of deltas contained in the patch.  The rest of the patch, the part
# that BitKeeper cares about, is below these diffs.
# User:	bar
# Host:	bar.myoffice.izhnet.ru
# Root:	/home/bar/mysql-5.1.b27898

--- 1.21/mysql-test/r/xml.result	2007-01-22 13:28:51 +04:00
+++ 1.22/mysql-test/r/xml.result	2007-05-02 13:18:03 +05:00
@@ -547,6 +547,13 @@ UpdateXML(@xml, '/a/b/@bb2', '')
 select UpdateXML(@xml, '/a/b/@bb2', 'bb3="bb3"');
 UpdateXML(@xml, '/a/b/@bb2', 'bb3="bb3"')
 <a aa1="aa1" aa2="aa2"><b bb1="bb1" bb3="bb3">bb</b></a>
+select
updatexml('<div><div><span>1</span><span>2</span></div></div>',
+'/','<tr><td>1</td><td>2</td></tr>') as upd1;
+upd1
+<tr><td>1</td><td>2</td></tr>
+select updatexml('', '/', '') as upd2;
+upd2
+
 SET @xml= '<order><clerk>lesser wombat</clerk></order>';
 select extractvalue(@xml,'order/clerk');
 extractvalue(@xml,'order/clerk')

--- 1.19/mysql-test/t/xml.test	2006-12-27 18:14:24 +04:00
+++ 1.20/mysql-test/t/xml.test	2007-05-02 13:18:03 +05:00
@@ -232,6 +232,13 @@ select UpdateXML(@xml, '/a/b/@bb2', '');
 select UpdateXML(@xml, '/a/b/@bb2', 'bb3="bb3"');
 
 #
+# Bug#27898 UPDATEXML Crashes the Server!
+#
+select
updatexml('<div><div><span>1</span><span>2</span></div></div>',
+                 '/','<tr><td>1</td><td>2</td></tr>')
as upd1;
+select updatexml('', '/', '') as upd2;
+
+#
 #  Bug#16234 XML: Crash if ExtractValue()
 #
 SET @xml= '<order><clerk>lesser wombat</clerk></order>';

--- 1.26/sql/item_xmlfunc.cc	2007-02-24 14:43:10 +04:00
+++ 1.27/sql/item_xmlfunc.cc	2007-05-02 13:18:03 +05:00
@@ -2768,6 +2768,16 @@ String *Item_func_xml_update::val_str(St
 
   nodebeg+= fltbeg->num;
 
+  if (!nodebeg->level)
+  {
+    /*
+      Root element, without NameTest:
+      UpdateXML(xml, '/', 'replacement');
+      Just return the replacement string.
+    */
+    return rep;
+  }
+
   tmp_value.length(0);
   tmp_value.set_charset(collation.collation);
   uint offs= nodebeg->type == MY_XML_NODE_TAG ? 1 : 0;