bzr push into mysql-5.1-bugteam branch (Sergey.Glukhov:2769 to 2770) Bug#42495

[Sergey Glukhov]

 2770 Sergey Glukhov	2009-02-04
      Bug#42495 updatexml: Assertion failed: xpath->context, file .\item_xmlfunc.cc, line 2507
      Problem:
         RelativeLocationPath can appear only after a node-set expression
         in the third and the fourth branches of this rule:
           PathExpr :: =  LocationPath
                          | FilterExpr
                          | FilterExpr '/' RelativeLocationPath
                          | FilterExpr '//' RelativeLocationPath
         XPatch code didn't check the type of FilterExpr and crashed.
      Fix:
         If FilterExpr is a scalar expression
         (variable reference, literal, number, scalar function call)
         return error.
modified:
  mysql-test/r/xml.result
  mysql-test/t/xml.test
  sql/item_xmlfunc.cc

 2769 Davi Arnaut	2009-02-04 [merge]
      Merge from upstream 5.1-bugteam
modified:
  mysql-test/suite/rpl_ndb/t/disabled.def
  sql/log_event.cc

=== modified file 'mysql-test/r/xml.result'
--- a/mysql-test/r/xml.result	2008-12-10 09:05:57 +0000
+++ b/mysql-test/r/xml.result	2009-02-04 11:40:12 +0000
@@ -1053,4 +1053,15 @@ ExtractValue('<xml  xxx  "yyy">CharData<
 NULL
 Warnings:
 Warning	1525	Incorrect XML value: 'parse error at line 1 pos 17: STRING unexpected ('>' wanted)'
+set @x=10;
+select extractvalue('<a></a>','$@x/a');
+ERROR HY000: XPATH syntax error: '/a'
+select extractvalue('<a></a>','round(123.4)/a');
+ERROR HY000: XPATH syntax error: '/a'
+select extractvalue('<a></a>','1/a');
+ERROR HY000: XPATH syntax error: '/a'
+select extractvalue('<a></a>','"b"/a');
+ERROR HY000: XPATH syntax error: '/a'
+select extractvalue('<a></a>','(1)/a');
+ERROR HY000: XPATH syntax error: '/a'
 End of 5.1 tests

=== modified file 'mysql-test/t/xml.test'
--- a/mysql-test/t/xml.test	2008-12-10 09:05:57 +0000
+++ b/mysql-test/t/xml.test	2009-02-04 11:40:12 +0000
@@ -575,5 +575,19 @@ SELECT ExtractValue(@xml, 'html/body');
 SELECT ExtractValue('<xml "xxx" "yyy">CharData</xml>', '/xml');
 SELECT ExtractValue('<xml  xxx  "yyy">CharData</xml>', '/xml');
 
+#
+# Bug#42495 updatexml: Assertion failed: xpath->context, file .\item_xmlfunc.cc, line 2507
+#
+set @x=10;
+--error ER_UNKNOWN_ERROR
+select extractvalue('<a></a>','$@x/a');
+--error ER_UNKNOWN_ERROR
+select extractvalue('<a></a>','round(123.4)/a');
+--error ER_UNKNOWN_ERROR
+select extractvalue('<a></a>','1/a');
+--error ER_UNKNOWN_ERROR
+select extractvalue('<a></a>','"b"/a');
+--error ER_UNKNOWN_ERROR
+select extractvalue('<a></a>','(1)/a');
 
 --echo End of 5.1 tests

=== modified file 'sql/item_xmlfunc.cc'
--- a/sql/item_xmlfunc.cc	2007-10-30 08:03:34 +0000
+++ b/sql/item_xmlfunc.cc	2009-02-04 11:40:12 +0000
@@ -1969,6 +1969,13 @@ my_xpath_parse_FilterExpr_opt_slashes_Re
   if (!my_xpath_parse_term(xpath, MY_XPATH_LEX_SLASH))
     return 1;
 
+  if (xpath->item->type() != Item::XPATH_NODESET)
+  {
+    xpath->lasttok= xpath->prevtok;
+    xpath->error= 1;
+    return 0;
+  }
+
   my_xpath_parse_term(xpath, MY_XPATH_LEX_SLASH);
   return my_xpath_parse_RelativeLocationPath(xpath);
 }
@@ -1976,7 +1983,6 @@ static int my_xpath_parse_PathExpr(MY_XP
 {
   return my_xpath_parse_LocationPath(xpath) || 
          my_xpath_parse_FilterExpr_opt_slashes_RelativeLocationPath(xpath);
-         
 }