Commit 025ddfea authored by unknown's avatar unknown
Browse files

InnoDB cleanup: fixing buffer overflows and quoting of quotes 


innobase/dict/dict0crea.c:
  Remove unneeded prototypes for static functions
  Remove unused parameters from some functions
  Replace some assertions with compile-time checks
  dict_create_add_foreigns_to_dictionary():
  allocate space dynamically for the SQL, and quote quotes
innobase/dict/dict0dict.c:
  Remove unnecessary prototypes for static functions
  dict_tables_have_same_db(): Remove length limitation
  dict_remove_db_name(): Use strchr()
  dict_get_db_name_len(): Use strchr()
  Replace mem_heap_alloc()+strlen()+memcpy() with mem_heap_strdup()
  Remove unnecessary strlen() calls
  Allocate space dynamically for generated strings
  dict_scan_id(): allow quotes within quoted strings
innobase/dict/dict0load.c:
  Remove unnecessary strlen() calls
  Replace mem_heap_alloc()+strlen()+memcpy() with mem_heap_strdup()
innobase/dict/dict0mem.c:
  Replace mem_heap_alloc()+strlen()+memcpy() with mem_heap_strdup()
innobase/eval/eval0eval.c:
  Make TO_CHAR() work with any machine word width
innobase/fil/fil0fil.c:
  Replace mem_alloc()+strlen()+strcpy() with mem_strdup()
innobase/ibuf/ibuf0ibuf.c:
  Make some global variables static
  Add #ifdef UNIV_IBUF_DEBUG around debug statements
innobase/include/data0data.h:
  Add #ifdef UNIV_DEBUG around dtuple_validate()
innobase/include/data0data.ic:
  Replace = with == in ut_ad(tuple->magic_n == DATA_TUPLE_MAGIC_N)
innobase/include/dict0dict.h:
  Add const qualifiers
innobase/include/lock0lock.h:
  Add UL suffixes to unsigned long masks
innobase/include/log0log.h:
  Remove unused parameter "type" of log_group_write_buf()
innobase/include/mem0mem.h:
  Add mem_strdup(), mem_strdupl(), mem_strdupq(), mem_heap_strdup(),
  and mem_heap_strdupl()
innobase/include/mem0mem.ic:
  Add mem_strdup(), mem_strdupl(), mem_strdupq(), mem_heap_strdup(),
  and mem_heap_strdupl()
innobase/include/row0uins.h:
  Remove unused parameter "thr" of row_undo_ins()
innobase/include/row0undo.h:
  Remvoe unused parameter "thr" of row_undo_search_clust_to_pcur()
innobase/include/ut0byte.h:
  Add const qualifier to ut_cpy_in_lower_case()
  Remove parameter "len" of ut_cmp_in_lower_case()
innobase/include/ut0mem.h:
  Add ut_strlenq(), ut_strcpyq() and ut_memcpyq()
innobase/include/ut0mem.ic:
  Add ut_strlenq()
innobase/include/ut0ut.h:
  Declare ut_sprintf() as a printf-style function
innobase/lock/lock0lock.c:
  lock_clust_rec_modify_check_and_lock(): Remove unused variable "trx"
innobase/log/log0log.c:
  Remove unused parameters
innobase/log/log0recv.c:
  Remove parameter "type" from log_group_write_buf()
innobase/mem/mem0mem.c:
  Simplify the initialization of block->init_block
innobase/mtr/mtr0log.c:
  Add a debug assertion to mlog_parse_initial_log_record()
innobase/page/page0cur.c:
  Add debug assertion to page_cur_insert_rec_write_log()
  Remove hard-coded buffer size in page_cur_parse_insert_rec()
innobase/page/page0page.c:
  Remove unneeded variable rec
innobase/pars/pars0opt.c:
  Correct a potential buffer overflow
innobase/pars/pars0pars.c:
  Replace mem_heap_alloc()+strlen()+memcpy() with mem_heap_strdup()
innobase/row/row0ins.c:
  Replace parameter "thr" with "trx" in row_ins_foreign_report_add_err()
  Remove unnecessary strlen() call
  Use strchr()
innobase/row/row0mysql.c:
  Add row_mysql_is_recovered_tmp_table()
  Add row_mysql_is_system_table()
  Compare reserved table names with exact match
  Use strstr() and strchr() and mem_strdupl()
  Compute space needed for generated SQL, and allocate it dynamically
innobase/row/row0purge.c:
  Remove unused parameters "thr"
innobase/row/row0row.c:
  Simplify row_get_clust_rec()
innobase/row/row0uins.c:
  Remove unused parameters "thr"
innobase/row/row0umod.c:
  Remove unused variable "index"
  row_undo_mod_del_unmark_sec_and_undo_update():
   Remove parameter "node" and variable "rec"
  Remove unused parameters "thr"
innobase/row/row0undo.c:
  Remove unused parameters "thr"
innobase/srv/srv0srv.c:
  Replace UT_NOT_USED() with __attribute__((unused))
innobase/srv/srv0start.c:
  Remove unnecessary strlen() calls
  Remove unused parameter "create_new_db" of open_or_create_log_file()
innobase/trx/trx0roll.c:
  Replace mem_alloc()+strlen()+memcpy() with mem_strdup()
innobase/trx/trx0sys.c:
  Remove unnecessary strlen() call
innobase/ut/ut0byte.c:
  Add const qualifier to ut_cpy_in_lower_case()
  Remove parameter "len" of ut_cmp_in_lower_case()
innobase/ut/ut0mem.c:
  Add ut_strlenq() and ut_memcpyq()
sql/ha_innodb.cc:
  Remove parameter "len" of ut_cmp_in_lower_case()
parent 95367941

innobase/dict/dict0crea.c

+77 −111
Original line number Diff line number Diff line
@@ -37,67 +37,6 @@ static 
dtuple_t*

dict_create_sys_tables_tuple(

/*=========================*/

				/* out: the tuple which should be inserted */

	dict_table_t*	table, 	/* in: table */

	mem_heap_t*	heap);	/* in: memory heap from which the memory for

				the built tuple is allocated */

/*********************************************************************

Based on a table object, this function builds the entry to be inserted

in the SYS_COLUMNS system table. */

static

dtuple_t*

dict_create_sys_columns_tuple(

/*==========================*/

				/* out: the tuple which should be inserted */

	dict_table_t*	table, 	/* in: table */

	ulint		i,	/* in: column number */

	mem_heap_t*	heap);	/* in: memory heap from which the memory for

				the built tuple is allocated */

/*********************************************************************

Based on an index object, this function builds the entry to be inserted

in the SYS_INDEXES system table. */

static

dtuple_t*

dict_create_sys_indexes_tuple(

/*==========================*/

				/* out: the tuple which should be inserted */

	dict_index_t*	index, 	/* in: index */

	mem_heap_t*	heap,	/* in: memory heap from which the memory for

				the built tuple is allocated */

	trx_t*		trx);	/* in: transaction handle */

/*********************************************************************

Based on an index object, this function builds the entry to be inserted

in the SYS_FIELDS system table. */

static

dtuple_t*

dict_create_sys_fields_tuple(

/*=========================*/

				/* out: the tuple which should be inserted */

	dict_index_t*	index, 	/* in: index */

	ulint		i,	/* in: field number */

	mem_heap_t*	heap);	/* in: memory heap from which the memory for

				the built tuple is allocated */

/*********************************************************************

Creates the tuple with which the index entry is searched for

writing the index tree root page number, if such a tree is created. */

static

dtuple_t*

dict_create_search_tuple(

/*=====================*/

				/* out: the tuple for search */

	dtuple_t*	tuple,	/* in: the tuple inserted in the SYS_INDEXES

				table */

	mem_heap_t*	heap);	/* in: memory heap from which the memory for

				the built tuple is allocated */



/*********************************************************************

Based on a table object, this function builds the entry to be inserted

in the SYS_TABLES system table. */

static

dtuple_t*

dict_create_sys_tables_tuple(

/*=========================*/

				/* out: the tuple which should be inserted */

	dict_table_t*	table, 	/* in: table */

	mem_heap_t*	heap)	/* in: memory heap from which the memory for

				the built tuple is allocated */
@@ -331,9 +270,8 @@ dict_create_sys_indexes_tuple( 
/*==========================*/

				/* out: the tuple which should be inserted */

	dict_index_t*	index, 	/* in: index */

	mem_heap_t*	heap,	/* in: memory heap from which the memory for

	mem_heap_t*	heap)	/* in: memory heap from which the memory for

				the built tuple is allocated */

	trx_t*		trx)	/* in: transaction handle */

{

	dict_table_t*	sys_indexes;

	dict_table_t*	table;
@@ -341,7 +279,6 @@ dict_create_sys_indexes_tuple( 
	dfield_t*	dfield;

	byte*		ptr;



	UT_NOT_USED(trx);

#ifdef UNIV_SYNC_DEBUG

	ut_ad(mutex_own(&(dict_sys->mutex)));

#endif /* UNIV_SYNC_DEBUG */
@@ -387,7 +324,9 @@ dict_create_sys_indexes_tuple( 
	dfield_set_data(dfield, ptr, 4);

	/* 7: SPACE --------------------------*/



	ut_a(DICT_SYS_INDEXES_SPACE_NO_FIELD == 7);

#if DICT_SYS_INDEXES_SPACE_NO_FIELD != 7

#error "DICT_SYS_INDEXES_SPACE_NO_FIELD != 7"

#endif



	dfield = dtuple_get_nth_field(entry, 5);
@@ -397,7 +336,9 @@ dict_create_sys_indexes_tuple( 
	dfield_set_data(dfield, ptr, 4);

	/* 8: PAGE_NO --------------------------*/



	ut_a(DICT_SYS_INDEXES_PAGE_NO_FIELD == 8);

#if DICT_SYS_INDEXES_PAGE_NO_FIELD != 8

#error "DICT_SYS_INDEXES_PAGE_NO_FIELD != 8"

#endif



	dfield = dtuple_get_nth_field(entry, 6);
@@ -565,8 +506,7 @@ dict_build_index_def_step( 


	index->page_no = FIL_NULL;

	

	row = dict_create_sys_indexes_tuple(index, node->heap,

							thr_get_trx(thr));

	row = dict_create_sys_indexes_tuple(index, node->heap);

	node->ind_row = row;



	ins_node_set_new_row(node->ind_def, row);
@@ -602,7 +542,6 @@ ulint 
dict_create_index_tree_step(

/*========================*/

				/* out: DB_SUCCESS or DB_OUT_OF_FILE_SPACE */

	que_thr_t*	thr,	/* in: query thread */

	ind_node_t*	node)	/* in: index create node */

{

	dict_index_t*	index;
@@ -615,7 +554,6 @@ dict_create_index_tree_step( 
#ifdef UNIV_SYNC_DEBUG

	ut_ad(mutex_own(&(dict_sys->mutex)));

#endif /* UNIV_SYNC_DEBUG */

	UT_NOT_USED(thr);



	index = node->index;	

	table = node->table;
@@ -963,7 +901,7 @@ dict_create_index_step( 


	if (node->state == INDEX_CREATE_INDEX_TREE) {



		err = dict_create_index_tree_step(thr, node);

		err = dict_create_index_tree_step(node);



		if (err != DB_SUCCESS) {
@@ -1166,11 +1104,22 @@ dict_create_add_foreigns_to_dictionary( 
	que_t*		graph;

	ulint		number	= start_id + 1;

	ulint		len;

	ulint		namelen;

	ulint		error;

	char*		ebuf	= dict_foreign_err_buf;

	ulint		i;

	char		buf[10000];

	char*		sql;

	char*		sqlend;

	/* This procedure builds an InnoDB stored procedure which will insert

	the necessary rows into SYS_FOREIGN and SYS_FOREIGN_COLS. */

	static const char str1[] = "PROCEDURE ADD_FOREIGN_DEFS_PROC () IS\n"

	"BEGIN\n"

	"INSERT INTO SYS_FOREIGN VALUES(";

	static const char str2[] = ");\n";

	static const char str3[] =

	"INSERT INTO SYS_FOREIGN_COLS VALUES(";

	static const char str4[] =

	"COMMIT WORK;\n"

	"END;\n";



#ifdef UNIV_SYNC_DEBUG

	ut_ad(mutex_own(&(dict_sys->mutex)));
@@ -1190,58 +1139,75 @@ dict_create_add_foreigns_to_dictionary( 
		return(DB_SUCCESS);

	}



	/* Build an InnoDB stored procedure which will insert the necessary

	rows to SYS_FOREIGN and SYS_FOREIGN_COLS */



	len = 0;

	

	len += sprintf(buf,

	"PROCEDURE ADD_FOREIGN_DEFS_PROC () IS\n"

	"BEGIN\n");



	namelen = strlen(table->name);

	ut_a(namelen < MAX_TABLE_NAME_LEN);



	if (foreign->id == NULL) {

		/* Generate a new constraint id */

		foreign->id = mem_heap_alloc(foreign->heap, namelen + 20);

		ulint	namelen	= strlen(table->name);

		char*	id	= mem_heap_alloc(foreign->heap, namelen + 20);

		/* no overflow if number < 1e13 */

		sprintf(foreign->id, "%s_ibfk_%lu", table->name, number);

		number++;

		sprintf(id, "%s_ibfk_%lu", table->name, number++);

		foreign->id = id;

	}



	ut_a(strlen(foreign->id) < MAX_IDENTIFIER_LEN);

	ut_a(len < (sizeof buf)

		- 46 - 2 * MAX_TABLE_NAME_LEN - MAX_IDENTIFIER_LEN - 20);

	len = (sizeof str1) + (sizeof str2) + (sizeof str4) - 3

		+ 9/* ' and , chars */ + 10/* 32-bit integer */

		+ ut_strlenq(foreign->id, '\'') * (foreign->n_fields + 1)

		+ ut_strlenq(table->name, '\'')

		+ ut_strlenq(foreign->referenced_table_name, '\'');



	for (i = 0; i < foreign->n_fields; i++) {

		len += 9/* ' and , chars */ + 10/* 32-bit integer */

			+ (sizeof str3) + (sizeof str2) - 2

			+ ut_strlenq(foreign->foreign_col_names[i], '\'')

			+ ut_strlenq(foreign->referenced_col_names[i], '\'');

	}



	len += sprintf(buf + len,

	"INSERT INTO SYS_FOREIGN VALUES('%s', '%s', '%s', %lu);\n",

					foreign->id,

					table->name,

					foreign->referenced_table_name,

					foreign->n_fields

					+ (foreign->type << 24));

	sql = sqlend = mem_alloc(len + 1);



	/* INSERT INTO SYS_FOREIGN VALUES(...); */

	memcpy(sqlend, str1, (sizeof str1) - 1);

	sqlend += (sizeof str1) - 1;

	*sqlend++ = '\'';

	sqlend = ut_strcpyq(sqlend, '\'', foreign->id);

	*sqlend++ = '\'', *sqlend++ = ',', *sqlend++ = '\'';

	sqlend = ut_strcpyq(sqlend, '\'', table->name);

	*sqlend++ = '\'', *sqlend++ = ',', *sqlend++ = '\'';

	sqlend = ut_strcpyq(sqlend, '\'', foreign->referenced_table_name);

	*sqlend++ = '\'', *sqlend++ = ',';

	sqlend += sprintf(sqlend, "%010lu",

			foreign->n_fields + (foreign->type << 24));

	memcpy(sqlend, str2, (sizeof str2) - 1);

	sqlend += (sizeof str2) - 1;



	for (i = 0; i < foreign->n_fields; i++) {

		ut_a(len < (sizeof buf)

			- 51 - 2 * MAX_COLUMN_NAME_LEN

			- MAX_IDENTIFIER_LEN - 20);



		len += sprintf(buf + len,

	"INSERT INTO SYS_FOREIGN_COLS VALUES('%s', %lu, '%s', '%s');\n",

					foreign->id,

					i,

					foreign->foreign_col_names[i],

		/* INSERT INTO SYS_FOREIGN_COLS VALUES(...); */

		memcpy(sqlend, str3, (sizeof str3) - 1);

		sqlend += (sizeof str3) - 1;

		*sqlend++ = '\'';

		sqlend = ut_strcpyq(sqlend, '\'', foreign->id);

		*sqlend++ = '\''; *sqlend++ = ',';

		sqlend += sprintf(sqlend, "%010lu", i);

		*sqlend++ = ','; *sqlend++ = '\'';

		sqlend = ut_strcpyq(sqlend, '\'',

			foreign->foreign_col_names[i]);

		*sqlend++ = '\''; *sqlend++ = ','; *sqlend++ = '\'';

		sqlend = ut_strcpyq(sqlend, '\'',

			foreign->referenced_col_names[i]);

		*sqlend++ = '\'';

		memcpy(sqlend, str2, (sizeof str2) - 1);

		sqlend += (sizeof str2) - 1;

	}



	ut_a(len < (sizeof buf) - 19);

	len += sprintf(buf + len,"COMMIT WORK;\nEND;\n");

	memcpy(sqlend, str4, sizeof str4);

	sqlend += sizeof str4;



	graph = pars_sql(buf);

	ut_a(sqlend == sql + len + 1);



	graph = pars_sql(sql);



	ut_a(graph);



	mem_free(sql);



	graph->trx = trx;

	trx->graph = NULL;

innobase/dict/dict0dict.c

+243 −287

File changed.

Preview size limit exceeded, changes collapsed.

innobase/dict/dict0load.c

+24 −70
Original line number Diff line number Diff line
@@ -39,7 +39,6 @@ dict_get_first_table_name_in_db( 
	rec_t*		rec;

	byte*		field;

	ulint		len;

	char*		table_name;

	mtr_t		mtr;

	

#ifdef UNIV_SYNC_DEBUG
@@ -91,9 +90,7 @@ dict_get_first_table_name_in_db( 


		/* We found one */



		table_name = mem_alloc(len + 1);

		ut_memcpy(table_name, field, len);

		table_name[len] = '\0';

		char*	table_name = mem_strdupl(field, len);

		

		btr_pcur_close(&pcur);

		mtr_commit(&mtr);
@@ -122,7 +119,6 @@ dict_print(void) 
	rec_t*		rec;

	byte*		field;

	ulint		len;

	char		table_name[10000];

	mtr_t		mtr;

	

	mutex_enter(&(dict_sys->mutex));
@@ -156,14 +152,14 @@ dict_print(void) 


		/* We found one */



		ut_memcpy(table_name, field, len);

		table_name[len] = '\0';

		char*	table_name = mem_strdupl(field, len);



		btr_pcur_store_position(&pcur, &mtr);



		mtr_commit(&mtr);



		table = dict_table_get_low(table_name);

		mem_free(table_name);



		if (table == NULL) {

			fprintf(stderr, "InnoDB: Failed to load table %s\n",
@@ -205,7 +201,6 @@ dict_load_columns( 
	byte*		field;

	ulint		len;

	byte*		buf;

	char*		name_buf;

	char*		name;

	ulint		mtype;

	ulint		prtype;
@@ -256,12 +251,7 @@ dict_load_columns( 
			dict_table_get_first_index(sys_columns), 4))->name));



		field = rec_get_nth_field(rec, 4, &len);



		name_buf = mem_heap_alloc(heap, len + 1);

		ut_memcpy(name_buf, field, len);

		name_buf[len] = '\0';



		name = name_buf;

		name = mem_heap_strdupl(heap, field, len);



		field = rec_get_nth_field(rec, 5, &len);

		mtype = mach_read_from_4(field);
@@ -304,7 +294,6 @@ dict_load_fields( 
	btr_pcur_t	pcur;

	dtuple_t*	tuple;

	dfield_t*	dfield;

	char*		col_name;

	ulint		pos_and_prefix_len;

	ulint		prefix_len;

	rec_t*		rec;
@@ -383,11 +372,8 @@ dict_load_fields( 


		field = rec_get_nth_field(rec, 4, &len);



		col_name = mem_heap_alloc(heap, len + 1);

		ut_memcpy(col_name, field, len);

		col_name[len] = '\0';

		

		dict_mem_index_add_field(index, col_name, 0, prefix_len);

		dict_mem_index_add_field(index,

			mem_heap_strdupl(heap, field, len), 0, prefix_len);



		btr_pcur_move_to_next_user_rec(&pcur, &mtr);

	}
@@ -492,10 +478,7 @@ dict_load_indexes( 
			dict_table_get_first_index(sys_indexes), 4))->name));

		

		field = rec_get_nth_field(rec, 4, &name_len);



		name_buf = mem_heap_alloc(heap, name_len + 1);

		ut_memcpy(name_buf, field, name_len);

		name_buf[name_len] = '\0';

		name_buf = mem_heap_strdupl(heap, field, name_len);



		field = rec_get_nth_field(rec, 5, &len);

		n_fields = mach_read_from_4(field);
@@ -544,7 +527,7 @@ dict_load_indexes( 
		if (is_sys_table

		    && ((type & DICT_CLUSTERED)

		        || ((table == dict_sys->sys_tables)

		            && (name_len == ut_strlen("ID_IND"))

		            && (name_len == (sizeof "ID_IND") - 1)

			    && (0 == ut_memcmp(name_buf, (char*)"ID_IND",

							name_len))))) {
@@ -593,7 +576,6 @@ dict_load_table( 
	rec_t*		rec;

	byte*		field;

	ulint		len;

	char*		buf;

	ulint		space;

	ulint		n_cols;

	ulint		err;
@@ -674,15 +656,13 @@ dict_load_table( 


	if (table->type == DICT_TABLE_CLUSTER_MEMBER) {

		ut_error;

	

#if 0 /* clustered tables have not been implemented yet */

		field = rec_get_nth_field(rec, 6, &len);

		table->mix_id = mach_read_from_8(field);



		field = rec_get_nth_field(rec, 8, &len);

		buf = mem_heap_alloc(heap, len);

		ut_memcpy(buf, field, len);



		table->cluster_name = buf;

		table->cluster_name = mem_heap_strdupl(heap, field, len);

#endif

	}



	if ((table->type == DICT_TABLE_CLUSTER)
@@ -751,7 +731,6 @@ dict_load_table_on_id( 
	byte*		field;

	ulint		len;	

	dict_table_t*	table;

	char*		name;

	mtr_t		mtr;

	

#ifdef UNIV_SYNC_DEBUG
@@ -814,13 +793,8 @@ dict_load_table_on_id( 
		

	/* Now we get the table name from the record */

	field = rec_get_nth_field(rec, 1, &len);



	name = mem_heap_alloc(heap, len + 1);

	ut_memcpy(name, field, len);

	name[len] = '\0';

	

	/* Load the table definition to memory */

	table = dict_load_table(name);

	table = dict_load_table(mem_heap_strdupl(heap, field, len));

	

	btr_pcur_close(&pcur);

	mtr_commit(&mtr);
@@ -867,7 +841,6 @@ dict_load_foreign_cols( 
	btr_pcur_t	pcur;

	dtuple_t*	tuple;

	dfield_t*	dfield;

	char*		col_name;

	rec_t*		rec;

	byte*		field;

	ulint		len;
@@ -912,20 +885,12 @@ dict_load_foreign_cols( 
		ut_a(i == mach_read_from_4(field));



		field = rec_get_nth_field(rec, 4, &len);



		col_name = mem_heap_alloc(foreign->heap, len + 1);

		ut_memcpy(col_name, field, len);

		col_name[len] = '\0';



		foreign->foreign_col_names[i] = col_name;

		foreign->foreign_col_names[i] =

			mem_heap_strdupl(foreign->heap, field, len);



		field = rec_get_nth_field(rec, 5, &len);



		col_name = mem_heap_alloc(foreign->heap, len + 1);

		ut_memcpy(col_name, field, len);

		col_name[len] = '\0';



		foreign->referenced_col_names[i] = col_name;

		foreign->referenced_col_names[i] =

			mem_heap_strdupl(foreign->heap, field, len);



		btr_pcur_move_to_next_user_rec(&pcur, &mtr);

	}
@@ -1023,23 +988,15 @@ dict_load_foreign( 
	foreign->type = foreign->n_fields >> 24;

	foreign->n_fields = foreign->n_fields & 0xFFFFFF;

	

	foreign->id = mem_heap_alloc(foreign->heap, ut_strlen(id) + 1);

				

	ut_memcpy(foreign->id, id, ut_strlen(id) + 1);

	foreign->id = mem_heap_strdup(foreign->heap, id);



	field = rec_get_nth_field(rec, 3, &len);

							

	foreign->foreign_table_name = mem_heap_alloc(foreign->heap, 1 + len);

				

	ut_memcpy(foreign->foreign_table_name, field, len);

	foreign->foreign_table_name[len] = '\0';	

	foreign->foreign_table_name =

		mem_heap_strdupl(foreign->heap, field, len);

	

	field = rec_get_nth_field(rec, 4, &len);

							

	foreign->referenced_table_name = mem_heap_alloc(foreign->heap,

								1 + len);

	ut_memcpy(foreign->referenced_table_name, field, len);

	foreign->referenced_table_name[len] = '\0';	

	foreign->referenced_table_name =

		mem_heap_strdupl(foreign->heap, field, len);



	btr_pcur_close(&pcur);

	mtr_commit(&mtr);
@@ -1153,10 +1110,7 @@ dict_load_foreigns( 


	/* Now we get a foreign key constraint id */

	field = rec_get_nth_field(rec, 1, &len);



	id = mem_heap_alloc(heap, len + 1);

	ut_memcpy(id, field, len);

	id[len] = '\0';

	id = mem_heap_strdupl(heap, field, len);

	

	btr_pcur_store_position(&pcur, &mtr);

innobase/dict/dict0mem.c

+4 −16
Original line number Diff line number Diff line
@@ -49,9 +49,7 @@ dict_mem_table_create( 


	table->heap = heap;

	

	str = mem_heap_alloc(heap, 1 + ut_strlen(name));



	ut_strcpy(str, name);

	str = mem_heap_strdup(heap, name);



	table->type = DICT_TABLE_ORDINARY;

	table->name = str;
@@ -146,7 +144,6 @@ dict_mem_table_add_col( 
	ulint		len,	/* in: length */

	ulint		prec)	/* in: precision */

{

	char*		str;

	dict_col_t*	col;

	dtype_t*	type;
@@ -157,12 +154,8 @@ dict_mem_table_add_col( 


	col = dict_table_get_nth_col(table, table->n_def - 1);	



	str = mem_heap_alloc(table->heap, 1 + ut_strlen(name));



	ut_strcpy(str, name);



	col->ind = table->n_def - 1;

	col->name = str;

	col->name = mem_heap_strdup(table->heap, name);

	col->table = table;

	col->ord_part = 0;
@@ -188,7 +181,6 @@ dict_mem_index_create( 
	ulint	type,		/* in: DICT_UNIQUE, DICT_CLUSTERED, ... ORed */

	ulint	n_fields)	/* in: number of fields */

{

	char*		str;

	dict_index_t*	index;

	mem_heap_t*	heap;
@@ -199,13 +191,9 @@ dict_mem_index_create( 


	index->heap = heap;

	

	str = mem_heap_alloc(heap, 1 + ut_strlen(index_name));



	ut_strcpy(str, index_name);



	index->type = type;

	index->space = space;

	index->name = str;

	index->name = mem_heap_strdup(heap, index_name);

	index->table_name = table_name;

	index->table = NULL;

	index->n_def = 0;

innobase/eval/eval0eval.c

+49 −8
Original line number Diff line number Diff line
@@ -667,7 +667,6 @@ eval_predefined( 
{

	que_node_t*	arg1;

	lint		int_val;

	byte*		str1;

	byte*		data;

	int		func;
@@ -681,21 +680,63 @@ eval_predefined( 


	} else if (func == PARS_TO_CHAR_TOKEN) {



		/* Convert number to character string as a

		signed decimal integer. */



		ulint	uint_val;

		int	int_len;



		int_val = eval_node_get_int_val(arg1);



		data = eval_node_ensure_val_buf(func_node, 11);

		/* Determine the length of the string. */



		if (int_val == 0) {

			int_len = 1; /* the number 0 occupies 1 byte */

		} else {

			int_len = 0;

			if (int_val < 0) {

				uint_val = ((ulint) -int_val - 1) + 1;

				int_len++; /* reserve space for minus sign */

			} else {

				uint_val = (ulint) int_val;

			}

			for (; uint_val > 0; int_len++) {

				uint_val /= 10;

			}

		}



		/* allocate the string */

		data = eval_node_ensure_val_buf(func_node, int_len + 1);



		sprintf((char*)data, "%10li", int_val);

		/* add terminating NUL character */

		data[int_len] = 0;



		dfield_set_len(que_node_get_val(func_node), 10);

		/* convert the number */



		if (int_val == 0) {

			data[0] = '0';

		} else {

			int tmp;

			if (int_val < 0) {

				data[0] = '-'; /* preceding minus sign */

				uint_val = ((ulint) -int_val - 1) + 1;

			} else {

				uint_val = (ulint) int_val;

			}

			for (tmp = int_len; uint_val > 0; uint_val /= 10) {

				data[--tmp] = '0' + (uint_val % 10);

			}

		}



		dfield_set_len((dfield_t*) que_node_get_val(func_node),

			int_len);



		return;



	} else if (func == PARS_TO_NUMBER_TOKEN) {



		str1 = dfield_get_data(que_node_get_val(arg1));



		int_val = atoi((char*)str1);

		int_val = atoi((char*)

			dfield_get_data(que_node_get_val(arg1)));



	} else if (func == PARS_SYSDATE_TOKEN) {

		int_val = (lint)ut_time();