Merge lp:~gl-az/percona-server/5.5-915814 into lp:percona-server/5.5

[George Ormond Lorch III]

Corrected buffer allocation for query in replication slave event handler. Query buffers were being allocated at the wrong size causing query cache checks to read from and write to unallocated memory.

Fix addresses upstream MySQL issues 64624 and 62942.

Jenkins http://jenkins.percona.com/view/PS%205.5/job/percona-server-5.5-param/381/

[Alexey Kopytov (akopytov)]

review: Approve

=== modified file 'Percona-Server/sql/log_event.cc'
--- Percona-Server/sql/log_event.cc	2012-05-18 04:37:44 +0000
+++ Percona-Server/sql/log_event.cc	2012-05-25 00:05:24 +0000
@@ -3205,10 +3205,33 @@
                                       const char *query_arg, uint32 q_len_arg)
 {
   LEX_STRING new_db;
+  char* query_buf;
+  int query_buf_len;
   int expected_error,actual_error= 0;
   HA_CREATE_INFO db_options;
 
   /*
+    We must allocate some extra memory for query cache
+    The query buffer layout is:
+       buffer :==
+         <statement>   The input statement(s)
+         '\0'          Terminating null char  (1 byte)
+         <length>      Length of following current database name (size_t)
+         <db_name>     Name of current database
+         <flags>       Flags struct
+  */
+  query_buf_len = q_len_arg + 1 + sizeof(size_t) + thd->db_length
+                  + QUERY_CACHE_FLAGS_SIZE + 1;
+  if ((query_buf= (char *) thd->alloc(query_buf_len)))
+  {
+    memcpy(query_buf, query_arg, q_len_arg);
+    query_buf[q_len_arg]= 0;
+    memcpy(query_buf+q_len_arg+1, (char *) &thd->db_length, sizeof(size_t));
+  }
+  else
+    goto end;
+
+  /*
     Colleagues: please never free(thd->catalog) in MySQL. This would
     lead to bugs as here thd->catalog is a part of an alloced block,
     not an entire alloced block (see
@@ -3288,8 +3311,10 @@
   if (is_trans_keyword() || rpl_filter->db_ok(thd->db))
   {
     thd->set_time((time_t)when);
-    thd->set_query_and_id((char*)query_arg, q_len_arg,
+
+    thd->set_query_and_id((char*) query_buf, q_len_arg,
                           thd->charset(), next_query_id());
+ 
     thd->variables.pseudo_thread_id= thread_id;		// for temp tables
     DBUG_PRINT("query",("%s", thd->query()));
 
@@ -3352,7 +3377,7 @@
             result. This should be acceptable now. This is a reminder
             to fix this if any refactoring happens here sometime.
           */
-          thd->set_query((char*) query_arg, q_len_arg, thd->charset());
+          thd->set_query((char*) query_buf, q_len_arg, thd->charset());
         }
       }
       if (time_zone_len)
@@ -4887,12 +4912,25 @@
       enum enum_duplicates handle_dup;
       bool ignore= 0;
       char *load_data_query;
+      int query_buf_len;
 
       /*
+        We must allocate some extra memory for query cache
+        The query buffer layout is:
+           buffer :==
+             <statement>   The input statement(s)
+             '\0'          Terminating null char  (1 byte)
+             <length>      Length of following current database name (size_t)
+             <db_name>     Name of current database
+             <flags>       Flags struct
+      */
+      query_buf_len = get_query_buffer_length() + 1 + sizeof(size_t) + thd->db_length
+                  + QUERY_CACHE_FLAGS_SIZE + 1;
+      /*
         Forge LOAD DATA INFILE query which will be used in SHOW PROCESS LIST
         and written to slave's binlog if binlogging is on.
       */
-      if (!(load_data_query= (char *)thd->alloc(get_query_buffer_length() + 1)))
+      if (!(load_data_query= (char *)thd->alloc(query_buf_len)))
       {
         /*
           This will set thd->fatal_error in case of OOM. So we surely will notice
@@ -4903,6 +4941,7 @@
 
       print_query(FALSE, NULL, load_data_query, &end, NULL, NULL);
       *end= 0;
+      memcpy(end+1, (char *) &thd->db_length, sizeof(size_t));
       thd->set_query(load_data_query, (uint) (end - load_data_query));
 
       if (sql_ex.opt_flags & REPLACE_FLAG)