Merge lp:~gl-az/percona-server/5.1-915814 into lp:percona-server/5.1

[George Ormond Lorch III]

Corrected buffer allocation for query in replication slave event handler. Query buffers were being allocated at the wrong size causing query cache checks to read from and write to unallocated memory.

Fix addresses upstream MySQL issues 64624 and 62942.

Jenkins http://jenkins.percona.com/view/PS%205.1/job/percona-server-5.1-param/322/

[Alexey Kopytov (akopytov)]

review: Approve

=== modified file 'Percona-Server/sql/log_event.cc'
--- Percona-Server/sql/log_event.cc	2012-05-09 04:14:12 +0000
+++ Percona-Server/sql/log_event.cc	2012-05-25 00:06:26 +0000
@@ -3162,11 +3162,35 @@
                                       const char *query_arg, uint32 q_len_arg)
 {
   LEX_STRING new_db;
+  char* query_buf;
+  int query_buf_len;
   int expected_error,actual_error= 0;
   HA_CREATE_INFO db_options;
   bool process_log_slow_statement= false;
 
   /*
+    We must allocate some extra memory for query cache
+    The query buffer layout is:
+       buffer :==
+         <statement>   The input statement(s)
+         '\0'          Terminating null char  (1 byte)
+         <length>      Length of following current database name (size_t)
+         <db_name>     Name of current database
+         <flags>       Flags struct
+  */
+  query_buf_len = q_len_arg + 1 + sizeof(size_t) + thd->db_length
+                  + QUERY_CACHE_FLAGS_SIZE + 1;
+  if ((query_buf= (char *) thd->alloc(query_buf_len)))
+  {
+    memcpy(query_buf, query_arg, q_len_arg);
+    query_buf[q_len_arg]= 0;
+    memcpy(query_buf+q_len_arg+1, (char *) &thd->db_length, sizeof(size_t));
+  }
+  else
+    goto end;
+
+
+  /*
     Colleagues: please never free(thd->catalog) in MySQL. This would
     lead to bugs as here thd->catalog is a part of an alloced block,
     not an entire alloced block (see
@@ -3246,7 +3270,7 @@
   if (is_trans_keyword() || rpl_filter->db_ok(thd->db))
   {
     thd->set_time((time_t)when);
-    thd->set_query((char*)query_arg, q_len_arg);
+    thd->set_query((char*) query_buf, q_len_arg);
     VOID(pthread_mutex_lock(&LOCK_thread_count));
     thd->query_id = next_query_id();
     VOID(pthread_mutex_unlock(&LOCK_thread_count));
@@ -4821,12 +4845,26 @@
       enum enum_duplicates handle_dup;
       bool ignore= 0;
       char *load_data_query;
-
+      int query_buf_len;
+ 
+      /*
+       We must allocate some extra memory for query cache
+       The query buffer layout is:
+         buffer :==
+         <statement>   The input statement(s)
+         '\0'          Terminating null char  (1 byte)
+         <length>      Length of following current database name (size_t)
+         <db_name>     Name of current database
+         <flags>       Flags struct
+      */
+      query_buf_len = get_query_buffer_length() + 1 + sizeof(size_t)
+                      + thd->db_length + QUERY_CACHE_FLAGS_SIZE + 1;
+ 
       /*
         Forge LOAD DATA INFILE query which will be used in SHOW PROCESS LIST
         and written to slave's binlog if binlogging is on.
       */
-      if (!(load_data_query= (char *)thd->alloc(get_query_buffer_length() + 1)))
+      if (!(load_data_query= (char *) thd->alloc(query_buf_len)))
       {
         /*
           This will set thd->fatal_error in case of OOM. So we surely will notice
@@ -4837,6 +4875,7 @@
 
       print_query(FALSE, NULL, load_data_query, &end, NULL, NULL);
       *end= 0;
+      memcpy(end+1, (char *) &thd->db_length, sizeof(size_t));
       thd->set_query(load_data_query, (uint) (end - load_data_query));
 
       if (sql_ex.opt_flags & REPLACE_FLAG)