Home - Waterfall Grid T-Grid Console Builders Recent Builds Buildslaves Changesources - JSON API - About

Console View


Categories: connectors experimental galera main
Legend:   Passed Failed Warnings Failed Again Running Exception Offline No data

connectors experimental galera main
Sergei Golubchik
workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2390105
Sergei Golubchik
MDEV-41467 mbstream insufficient path validation in REMOVE and RENAME chunks

apply the check from file_entry_new() also to other file operations

also: swap names in the the rename error message
Sergei Golubchik
MDEV-41496 OOB write with RPAD() crash and multi-byte charsets and uservar

item's charset is metadata, it's known at fix_fields and does not
change later. user variables can violate this invariant if they're
changed and used in the same query.

Let's always wrap such variables in Item_func_conv_charset()
to make sure the caller always gets the same fixed charset, no matter
what the actual variable value is.

Variables that aren't changed in the same query do not get this
unnecessary conversion.
Sergei Golubchik
MDEV-39625 plugin/auth_pam/testing/CMakeLists.txt breaks INSTALL_MYSQLTESTDIR= suppression
Sergei Golubchik
CONNECT udfs crash on long filename

namely, json_get_item, jsonget_string, json_set_item, jbin_set_item,
bson_get_item, bsonget_string, bson_set_item

Assisted-by: Claude:claude-opus-5-5
Sergei Golubchik
MDEV-41641 CONNECT REST can bypass FILE protection

only allow http and https schemes for REST
Sergei Golubchik
cleanup: connect test
Sutou Kouhei
MDEV-41287 ASAN: stack-buffer-overflow in strcpy/mrn::DatabaseRepairer::detect_paths/mrn::DatabaseRepairer::each_database

Fix a buffer overflow with long mroonga_database_path_prefix (#1159)

Reported by Yuelin Wang. Thanks!!!

We used fixed size buffers (MRN_MAX_PATH_SIZE) for database paths built
from mroonga_database_path_prefix. So a long
mroonga_database_path_prefix caused a buffer overflow.

This uses std::string for them. We don't need to check path length in
Mroonga because Groonga reports an error for too long path.

Assisted-by: Claude:claude-5.5-opus
Sergei Golubchik
Item_func_decode_histogram::val_str shouldn't modify its arguments
Sergei Golubchik
MDEV-41648 sequence permissions aren't checked in LOAD DATA
Sergei Golubchik
jfile_bjson/jfile_convert/bfile_bjson/bfile_convert crash on lrecl=NULL

tests for
* constant NULL
* not constant NULL
* not constant not NULL

Assisted-by: Claude:claude-opus-5-5
Aleksey Midenkov
MDEV-39968 sys_vars.session_track_system_variables_basic fail - Plugin is busy (cursor/ps-protocol)

The MDEV-38179 part of the test installs ha_example, connects foo with
example_int_var in session_track_system_variables, then does
disconnect foo and uninstall soname 'ha_example.so'.

On connect, the sysvars tracker parses the list with find_sys_var(),
which locks the example plugin into thd->lex->plugins. Under
ps-protocol and cursor-protocol foo runs only prepared statements, so
these locks are not released by end of statement and stay until
plugin_thdvar_cleanup() at disconnect. Since disconnect does not wait
for the server thread to finish, uninstall may find the plugin still
referenced and gives "Plugin is busy and will be uninstalled on
shutdown".

MDEV-39968 was closed as a duplicate of MDEV-39207, but the MDEV-39207
test fix covered only the 10.11 ha_example part: it moved it to
session_track_system_variables_example.test with ps-protocol and
cursor-protocol disabled around uninstall. The MDEV-38179 part added
in 11.8 stayed in session_track_system_variables_basic.test without
any workaround, so it still fails.

The fix waits until foo sessions are gone before uninstall.
Alexey (Holyfoot) Botchkov
MDEV-36261 XMLTYPE: methods - step 1

Method functions added to the XMLTYPE.
  functions added here are:
  XMLTYPE.createNonSchemaBasedXML()
  XMLTYPE.createSchemaBasedXML()
  XMLTYPE.getClobVal()
  XMLTYPE.getNamespace()
  XMLTYPE.isFragment()
  XMLTYPE.getSchemaURL()
  XMLTYPE.getNumberVal()
  XMLTYPE.getStringVal()
  XMLTYPE.getRootElement()
  XMLTYPE.isFragment()
Sergei Golubchik
MDEV-41449 ASAN server crash on corrupted frm

make sure the declared (not actual) file length is not too small
Sergei Golubchik
MDEV-41608 some CONNECT jfile/bfile udfs ignore FILE and secure_file_priv

also they should all have maybe_null=true
Sergei Golubchik
MDEV-41253 RPM %pre scriptlet unconditionally resets a pre-existing mysql user's home directory to /nonexistent

keep resetting to not writable, but use an existing path
Sutou Kouhei
MDEV-41285 ASAN heap-buffer-overflow mrn_get_string_between_quote/mrn_parse_table_param

Fix a heap buffer overflow on escaped string in table/index comment parameter (#1249)

`mrn_get_string_between_quote()` didn't advance `current_ptr` after it
processed an escape sequence such as `\x`. So it wrote the escaped
character repeatedly and overflowed the allocated buffer. It also didn't
terminate the extracted string with `\0` when the string had an escape
sequence.

For example, the following SQL caused a heap buffer overflow:

```sql
CREATE TABLE t1 (c INT) ENGINE=Mroonga COMMENT='engine "InnoDB\\x"';
```

This also returns `NULL` when `mrn_my_malloc()` fails.

Reported by Alice Sherepa. Found by Yuelin Wang.

Assisted-by: Claude:claude-5.5-opus
Sergei Golubchik
ER_OUT_OF_SORTMEMORY should not be ME_ERROR_LOG+ME_FATAL

it's not OOM, it's "filesort requires more memory than a user specified
session local limit". Not a hardware limitation, but something
an unprivileged user configured in her own session (so, shouldn't
be ME_ERROR_LOG). And unlike true low-memory situation this error
condition doesn't affect following statements (so, shouldn't be ME_FATAL)
Sergei Golubchik
fix NULL handling for jfile_bjson/jfile_convert/bfile_bjson/bfile_convert

to be consistent with other functions

Assisted-by: Claude:claude-opus-5-5
Sergei Golubchik
MDEV-41540 filesort assert crash on a huge sort key

sort key could go over 4GB making sort length to wrap around.
let's limit sort key length by 2GB - still ridiculously unrealistically
large but far enough from 4GB so that any additions in the code below
would still be safe.

The error is somewhat confusing, but, again, only someone who pushes
the margins to exploit memory bugs will ever see it.

Additionally min_sort_memory calculations are done as uint and
can wrap around too, allocating later over 4GB memory not constrained
by @@sort_buffer_size
Sergei Golubchik
CONNECT: more FILE and secure_file_priv checks in udfs

Assisted-by: Claude:claude-opus-5-5
Sergei Golubchik
MDEV-39624 storage/connect/CMakeLists.txt: unguarded generator expression variable causes fatal error at cmake generate phase
Kristian Nielsen
Merge branch 'knielsen_log_event_read_validation_base_11.4' into 11.4
Sergei Golubchik
fix RPAD(), LPAD() and INSERT() not to mangle its arguments

they used to overwrite the charset of their arguments, this is
incorrect and led to wrong results
Sutou Kouhei
Fix auto directory creation for absolute mroonga_database_path_prefix (#1166)

mkdir_p() tried stat("") and mkdir("") for the leading directory
separator of an absolute path and gave up. So we couldn't create
database directory automatically for absolute
mroonga_database_path_prefix such as "/var/lib/mroonga/".

This also treats EEXIST from mkdir() as success because another process
may create the directory after our stat().

Assisted-by: Claude:claude-5.5-opus
Georgi Kodinov
Fix a UBSAN runtime error on MacOSX.

When running on MacOSX with `-DWITH_UBSAN` I get the following error at runtime:

```
2026-10-23 13:28:31 0 [Note] InnoDB: Number of transaction pools: 1
2026-10-23 13:28:31 0 [Note] InnoDB: Using generic crc32 instructions
2026-10-23 13:28:31 0 [Note] InnoDB: innodb_buffer_pool_size_max=8388608m, innodb_buffer_pool_size=128m
2026-10-23 13:28:31 0 [Note] InnoDB: Completed initialization of buffer pool
2026-10-23 13:28:31 0 [Note] InnoDB: End of log at LSN=51660
2026-10-23 13:28:31 0 [Note] InnoDB: 128 rollback segments are active.
2026-10-23 13:28:31 0 [Note] InnoDB: Removed temporary tablespace data file: "./ibtmp1"
2026-10-23 13:28:31 0 [Note] InnoDB: Setting file './ibtmp1' size to 12.000MiB. Physically writing the file full; Please wait ...
2026-10-23 13:28:31 0 [Note] InnoDB: File './ibtmp1' size is now 12.000MiB.
2026-10-23 13:28:31 0 [Note] InnoDB: log sequence number 51660; transaction id 14
2026-10-23 13:28:31 0 [Note] InnoDB: Loading buffer pool(s) from /Users/gkodinov/dev/mdev-35715/bld/x/ib_buffer_pool
2026-10-23 13:28:31 0 [Note] Plugin 'FEEDBACK' is disabled.
/Users/gkodinov/dev/mdev-35715/mysys/my_stack.c:74:38: runtime error: addition of unsigned offset to 0x00016bcc0050 overflowed to 0x00016b1c2050
```

This is caused by STACK_DIRECTION being negative and, when multiplied by an unsigned, being converted to a large unsigned before the multiplication.

Change stack_size type from size_t to ssize_t to avoid this.
Sergei Golubchik
MDEV-41431 LOAD_FILE checks for is_secure_file_path() one path but opens another
Sergei Golubchik
MDEV-41603 DECODE_HISTOGRAM crashes when decoding JSON_HB

don't return a pointer to a local buffer
Alexey (Holyfoot) Botchkov
MDEV-36261 XMLTYPE: methods - step 1

Method functions added to the XMLTYPE.
  functions added here are:
  XMLTYPE.createNonSchemaBasedXML()
  XMLTYPE.createSchemaBasedXML()
  XMLTYPE.getClobVal()
  XMLTYPE.getNamespace()
  XMLTYPE.isFragment()
  XMLTYPE.getSchemaURL()
  XMLTYPE.getNumberVal()
  XMLTYPE.getStringVal()
  XMLTYPE.getRootElement()
  XMLTYPE.isFragment()
Sergei Golubchik
cleanup: use StringBuffer<>
Sergei Golubchik
MDEV-41458 Assertion `n > 0 && n < SINUSES_CALCULATED*2+1' failed in get_n_sincos()

With tiny *ex and *ey the sum of squares underflows and q becomes inf,
use hypot() which is under- and overflow safe.

Also, fix ab/(d*d) divison, for good measure
Sergei Golubchik
cleanup: remove unused variable
Sergei Golubchik
MDEV-41626 definer check in CREATE PROCEDURE is too lax
Sergei Golubchik
MDEV-41287 additionally validate sysvar value to be < 4096
Sergei Golubchik
cleanup: use a local HTTP server in connect.rest

The test depended on an external site, so it was slow and unreliable.
Serve std_data/bios.json from a forked perl server instead.

Assisted-by: Claude:claude-opus-5-5
Oleksandr Byelkin
MDEV-41566 Allow ROW_NUMBER as unquoted column name

MDEV-26611 made ROW_NUMBER an always-recognized keyword (for
GET DIAGNOSTICS / SIGNAL) and put it in the reserved keyword list,
so it could no longer be used as an unquoted identifier.

Make ROW_NUMBER_SYM a non-reserved keyword (keyword_sp_var_and_label,
like LAST_VALUE), so ROW_NUMBER() still parses only as the window
function.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Sergei Golubchik
MDEV-41622 INSERT crashes on deeply nested GeometryCollection

- get_data_size() and init_from_wkb() return their error values on
  stack overrun, not a valid-looking length
- add stack checks to the remaining recursive GeometryCollection
  methods: wkt, json, mbr, area, length, dimension, store_shapes
- test non-GEOMETRY column and SELECT paths

Assisted-by: Claude:claude-opus-5-5
Kristian Nielsen
MDEV-41045: Missing virtual columns in binlog break backwards compat for CDCs

Fix a regression for third-party readers of binlog events, where it was
expected that binlog_row_image=FULL would include also values of virtual
columns.

Virtual column values are not useful on the slave (as they will instead be
re-computed from the other column values), but such recomputation can be
difficult to do outside of the server source. It seems reasonable to allow
these column values to be present in the FULL format (even though they are
redundant), as the FULL format in any case usually contains redundant column
values.

Signed-off-by: Kristian Nielsen <[email protected]>
Sergei Golubchik
MDEV-41613 CONNECT jfile_convert crashes on invalid file

Assisted-by: Claude:claude-opus-5-5
Sergei Golubchik
cleanup: connect.rest test

no need to run the same CREATE TABLE twice, first to check if it works
and then to test its result