bk commit into 4.1 tree (svoj:1.2688) BUG#11392

[Sergey Vojtovich]

Below is the list of changes that have just been committed into a local
4.1 repository of svoj. When svoj does a push these changes will
be propagated to the main repository and, within 24 hours after the
push, to the public repository.
For information on how to access the public repository
see http://dev.mysql.com/doc/mysql/en/installing-source-tree.html

ChangeSet@stripped, 2007-10-30 14:45:55+04:00, svoj@stripped +3 -0
  BUG#11392 - fulltext search bug
  
  Fulltext boolean mode phrase search may crash server on platforms
  where size of pointer is not equal to size of unsigned integer
  (in other words some 64-bit platforms).
  
  The problem was integer overflow.

  myisam/ft_boolean_search.c@stripped, 2007-10-30 14:45:54+04:00, svoj@stripped +2 -1
    my_match_t::beg is unsigned int, that means type of expression
    (m[0].beg - 1) has unsigned type too. It may happen that instr()
    finds substring in the beggining of passed string, returning
    m[0].beg equal to 0. In this case value of expression (m[0].beg - 1)
    is equal to MAX_UINT.
    
    This is not a problem on platforms where sizeof(pointer) equals to
    sizeof(uint). That means ptr[(uint)-1] = ptr[(uint)MAX_UINT] = ptr - 1.
    
    On some 64-bit platforms where sizeof(pointer) is 8 and sizeof(uint)
    is 4, wrong address gets accessed. In other words ptr[(uint)-1] is
    equal to ptr + MAX_UINT.

  mysql-test/r/fulltext.result@stripped, 2007-10-30 14:45:54+04:00, svoj@stripped +6 -0
    A test case for BUG#11392.

  mysql-test/t/fulltext.test@stripped, 2007-10-30 14:45:54+04:00, svoj@stripped +8 -0
    A test case for BUG#11392.

diff -Nrup a/myisam/ft_boolean_search.c b/myisam/ft_boolean_search.c
--- a/myisam/ft_boolean_search.c	2005-07-28 23:24:02 +05:00
+++ b/myisam/ft_boolean_search.c	2007-10-30 14:45:54 +04:00
@@ -446,7 +446,8 @@ static int _ftb_strstr(const byte *s0, c
   {
     if (cs->coll->instr(cs, p0, e0 - p0, s1, e1 - s1, m, 2) != 2)
       return(0);
-    if ((!s_after || p0 + m[1].beg == s0 || !true_word_char(cs, p0[m[1].beg-1])) &&
+    if ((!s_after || p0 + m[1].beg == s0 ||
+         !true_word_char(cs, p0[(int) m[1].beg - 1])) &&
         (!e_before || p0 + m[1].end == e0 || !true_word_char(cs, p0[m[1].end])))
       return(1);
     p0+= m[1].beg;
diff -Nrup a/mysql-test/r/fulltext.result b/mysql-test/r/fulltext.result
--- a/mysql-test/r/fulltext.result	2007-04-13 02:31:32 +05:00
+++ b/mysql-test/r/fulltext.result	2007-10-30 14:45:54 +04:00
@@ -454,3 +454,9 @@ ALTER TABLE t1 DISABLE KEYS;
 SELECT * FROM t1 WHERE MATCH(a) AGAINST('test');
 ERROR HY000: Can't find FULLTEXT index matching the column list
 DROP TABLE t1;
+CREATE TABLE t1(a TEXT);
+INSERT INTO t1 VALUES(' aaaaa aaaa');
+SELECT * FROM t1 WHERE MATCH(a) AGAINST ('"aaaa"' IN BOOLEAN MODE);
+a
+ aaaaa aaaa
+DROP TABLE t1;
diff -Nrup a/mysql-test/t/fulltext.test b/mysql-test/t/fulltext.test
--- a/mysql-test/t/fulltext.test	2007-04-13 02:31:32 +05:00
+++ b/mysql-test/t/fulltext.test	2007-10-30 14:45:54 +04:00
@@ -379,4 +379,12 @@ ALTER TABLE t1 DISABLE KEYS;
 SELECT * FROM t1 WHERE MATCH(a) AGAINST('test');
 DROP TABLE t1;
 
+#
+# BUG#11392 - fulltext search bug
+#
+CREATE TABLE t1(a TEXT);
+INSERT INTO t1 VALUES(' aaaaa aaaa');
+SELECT * FROM t1 WHERE MATCH(a) AGAINST ('"aaaa"' IN BOOLEAN MODE);
+DROP TABLE t1;
+
 # End of 4.1 tests