bzr commit into mysql-5.1-bugteam branch (Sergey.Glukhov:2768) Bug#42495

[Sergey Glukhov]

#At file:///home/gluh/MySQL/mysql-5.1-bug-42495/ based on revid:patrick.crews@stripped

 2768 Sergey Glukhov	2009-02-03
      Bug#42495 updatexml: Assertion failed: xpath->context, file .\item_xmlfunc.cc, line 2507
      Problem:
      RelativeLocationPath can appear only after a node-set expression
      in the third and the fourth branches of this rule:
        PathExpr :: =  LocationPath
                       | FilterExpr
                       | FilterExpr '/' RelativeLocationPath
                       | FilterExpr '//' RelativeLocationPath
      XPatch code didn't check the type of FilterExpr and crashed.
      Fix:
      If FilterExpr is a scalar expression
      (variable reference, literal, number, scalar function call)
      return error.
modified:
  mysql-test/r/xml.result
  mysql-test/t/xml.test
  sql/item_xmlfunc.cc

per-file messages:
  mysql-test/r/xml.result
    test result
  mysql-test/t/xml.test
    test case
  sql/item_xmlfunc.cc
    Problem:
    RelativeLocationPath can appear only after a node-set expression
    in the third and the fourth branches of this rule:
      PathExpr :: =  LocationPath
                     | FilterExpr
                     | FilterExpr '/' RelativeLocationPath
                     | FilterExpr '//' RelativeLocationPath
    XPatch code didn't check the type of FilterExpr and crashed.
    Fix:
    If FilterExpr is a scalar expression
    (variable reference, literal, number, scalar function call)
    return error.
=== modified file 'mysql-test/r/xml.result'
--- a/mysql-test/r/xml.result	2008-12-10 09:05:57 +0000
+++ b/mysql-test/r/xml.result	2009-02-03 14:10:15 +0000
@@ -1053,4 +1053,15 @@ ExtractValue('<xml  xxx  "yyy">CharData<
 NULL
 Warnings:
 Warning	1525	Incorrect XML value: 'parse error at line 1 pos 17: STRING unexpected ('>' wanted)'
+set @x=10;
+select extractvalue('<a></a>','$@x/a');
+ERROR HY000: XPATH syntax error: '/a'
+select extractvalue('<a></a>','round(123.4)/a');
+ERROR HY000: XPATH syntax error: '/a'
+select extractvalue('<a></a>','1/a');
+ERROR HY000: XPATH syntax error: '/a'
+select extractvalue('<a></a>','"b"/a');
+ERROR HY000: XPATH syntax error: '/a'
+select extractvalue('<a></a>','(1)/a');
+ERROR HY000: XPATH syntax error: '/a'
 End of 5.1 tests

=== modified file 'mysql-test/t/xml.test'
--- a/mysql-test/t/xml.test	2008-12-10 09:05:57 +0000
+++ b/mysql-test/t/xml.test	2009-02-03 14:10:15 +0000
@@ -575,5 +575,19 @@ SELECT ExtractValue(@xml, 'html/body');
 SELECT ExtractValue('<xml "xxx" "yyy">CharData</xml>', '/xml');
 SELECT ExtractValue('<xml  xxx  "yyy">CharData</xml>', '/xml');
 
+#
+# Bug#42495 updatexml: Assertion failed: xpath->context, file .\item_xmlfunc.cc, line 2507
+#
+set @x=10;
+--error ER_UNKNOWN_ERROR
+select extractvalue('<a></a>','$@x/a');
+--error ER_UNKNOWN_ERROR
+select extractvalue('<a></a>','round(123.4)/a');
+--error ER_UNKNOWN_ERROR
+select extractvalue('<a></a>','1/a');
+--error ER_UNKNOWN_ERROR
+select extractvalue('<a></a>','"b"/a');
+--error ER_UNKNOWN_ERROR
+select extractvalue('<a></a>','(1)/a');
 
 --echo End of 5.1 tests

=== modified file 'sql/item_xmlfunc.cc'
--- a/sql/item_xmlfunc.cc	2007-10-30 08:03:34 +0000
+++ b/sql/item_xmlfunc.cc	2009-02-03 14:10:15 +0000
@@ -1969,6 +1969,13 @@ my_xpath_parse_FilterExpr_opt_slashes_Re
   if (!my_xpath_parse_term(xpath, MY_XPATH_LEX_SLASH))
     return 1;
 
+  if (xpath->item->type() != Item::XPATH_NODESET)
+  {
+    xpath->lasttok= xpath->prevtok;
+    xpath->error= 1;
+    return 0;
+  }
+
   my_xpath_parse_term(xpath, MY_XPATH_LEX_SLASH);
   return my_xpath_parse_RelativeLocationPath(xpath);
 }
@@ -1976,7 +1983,6 @@ static int my_xpath_parse_PathExpr(MY_XP
 {
   return my_xpath_parse_LocationPath(xpath) || 
          my_xpath_parse_FilterExpr_opt_slashes_RelativeLocationPath(xpath);
-         
 }