MySQL bug 13871079

------------------------------------------------------------
revno: 3313
tags: clone-5.5.24-build
committer: Tor Didriksen <tor.didriksen@oracle.com>
branch nick: 5.5-security
timestamp: Thu 2012-04-12 15:04:22 +0200
message:
  Bug#13871079 RQG_MYISAM_DML_ALTER_VALGRIND FAILS ON VALGRIND PN PB2

  The class Copy_field contains a String tmp,
  which may allocate memory on the heap.
  That means that all instances of Copy_field
  must be properly destroyed. Alas they are not.

  Solution: don't use Copy_field::tmp for copying
  from_field => tmp => to_field
  in do_field_string()


diff -Nau mysql-5.5.23/sql/field_conv.cc mysql-5.5.24/sql/field_conv.cc
--- mysql-5.5.23/sql/field_conv.cc  2012-03-29 21:07:12.000000000 +0200
+++ mysql-5.5.24/sql/field_conv.cc  2012-04-19 13:01:23.000000000 +0200
@@ -317,10 +317,11 @@
 static void do_field_string(Copy_field *copy)
 {
   char buff[MAX_FIELD_WIDTH];
-  copy->tmp.set_quick(buff,sizeof(buff),copy->tmp.charset());
-  copy->from_field->val_str(&copy->tmp);
-  copy->to_field->store(copy->tmp.c_ptr_quick(),copy->tmp.length(),
-                        copy->tmp.charset());
+  String res(buff, sizeof(buff), copy->from_field->charset());
+  res.length(0U);
+
+  copy->from_field->val_str(&res);
+  copy->to_field->store(res.c_ptr_quick(), res.length(), res.charset());
 }


@@ -563,7 +564,7 @@
 /*
   To do:

-  If 'save\ is set to true and the 'from' is a blob field, do_copy is set to
+  If 'save' is set to true and the 'from' is a blob field, do_copy is set to
   do_save_blob rather than do_conv_blob.  The only differences between them
   appears to be: