Home - Waterfall Grid T-Grid Console Builders Recent Builds Buildslaves Changesources - JSON API - About

Console View


Categories: connectors experimental galera main
Legend:   Passed Failed Warnings Failed Again Running Exception Offline No data

connectors experimental galera main
fe3d42bb5d91...
fe3d42bb5d91cbda6836922ad8fb4434ca7fb26c
Alexander Barkov
MDEV-40396 open SYS_REFCURSOR crash, if too many cursors

When THD::m_statement_cursor was resized by a call of alloc_dynamic,
the memory location of all sp_cursor::result changed.
Therefore all members "select_result *Server_side_cursor::select"
previously initialized in the constructor to addresses of
sp_cursor::result became invalid.

Fix:
- Removing the member "select_result *result;" from Server_side_cursor.
- Passing instead a new "select_result *" parameter to
  methods open() and fetch() of Server_side_cursor and its descendant
  Materialized cursor.

So now, for example, when sp_cursor::fetch() is called, it executes:

    server_side_cursor->fetch(&result/*new parameter*/, 1);

The address value `&result` is now always correct.
f9d82f5707ee...
f9d82f5707ee0e9778be725aaa936a0196c0e27b
Sergei Golubchik
MDEV-40425 handlersocket crashes on read with huge number of fields

* fix handlersocket to unlink it's THD, this apparently was broken
  for years
* add a check for fldnum
* add a first ever handlersocket test
f6113def628e...
f6113def628e3af506e7b0796eb05faa821f9904
Hemant Dangi
MDEV-28239: rsync and mariabackup SST scripts handle sst ssl_mode option differently

Issue:
The mariabackup SST script enabled a peer certificate name check
for any ssl-mode starting with VERIFY, so VERIFY_CA behaved like
VERIFY_IDENTITY, unlike the rsync script.

Solution:
For VERIFY_CA verify the chain only - drop the socat
"commonname" check in mariabackup and gate the rsync checkHost/checkIP
on VERIFY_IDENTITY.
ce3b1fd4abed...
ce3b1fd4abed7c95a7c4c46dbe62a87800307305
Hemant Dangi
MDEV-23744: Unable to specify both client and server certificates.

Issue: The SST TLS options are not role-specific, so a node cannot
present a different certificate as donor (TLS client) than as joiner
(TLS server), which some environments require.

Solution: In the shared check_server_ssl_config, add role-specific
options that override the generic ones: ssl-server-{ca,capath,cert,key}
for the joiner and ssl-client-{ca,capath,cert,key} for the donor.
Applies to both mariabackup and rsync SST.
cc92e95945be...
cc92e95945be554060cb7df7f8518fb4733e21cf
Alexey Botchkov
MDEV-31267 Server crash or assertion failure in get_n_sincos with nested ST_BUFFER.

The double precision is not enough when intersecting lines become too
parallel.
We can safely use border values for it.
c91b0161bb4f...
c91b0161bb4f0300b5d5c48c2d1c47b9bdb46bee
Alexander Barkov
MDEV-40396 open SYS_REFCURSOR crash, if too many cursors

When THD::m_statement_cursor was resized by a call of alloc_dynamic,
the memory location of all sp_cursor::result changed.
Therefore all members "select_result *Server_side_cursor::select"
previously initialized in the constructor to addresses of
sp_cursor::result became invalid.

Fix:
- Removing the member "select_result *result;" from Server_side_cursor.
- Passing instead a new "select_result *" parameter to
  methods open() and fetch() of Server_side_cursor and its descendant
  Materialized cursor.

So now, for example, when sp_cursor::fetch() is called, it executes:

    server_side_cursor->fetch(&result/*new parameter*/, 1);

The address value `&result` is now always correct.
b7ca517b7734...
b7ca517b7734d9772858d2acf309fd2f024b0204
Alexey Botchkov
Update submodule link
b75ce6728cb9...
b75ce6728cb91bbb5ab28e769e388e1d8c7e36eb
Alexey Botchkov
MDEV-39750 ExtractValue does not control recursion depth.

    More stack needed here.
b5aa486a1cd3...
b5aa486a1cd3072c2856bc353b03fce7e9b6651e
Dmitry Shulga
MDEV-36481: Abnormal server termination on second execution of stored routine that runs a cursor after table metadata in the query was changed

On parsing the statement 'DECLARE var1,...,varN TYPE OF cur DEFAULT value'
an instance of the class Item_splocal that created on handling the clause
'DEFAULT value' is shared between two classes sp_instr_cursor_copy_struct and
sp_instr_set. In result, in case metadata changed and cursor has to be re-parsed,
items associated with the SP instruction sp_instr_cursor_copy_struct
are deallocated and one of deallocated items is the one representing the value
the `DEFAULT value` clause. On the other hand, the data member
sp_instr_set::m_value still references the deallocated item. It leads to server
abnormal termination on second run of a stored routine containing the statement
'DECLARE ... TYPE OF ... DEFAULT value'

To fix the issue pass owning of an instance of the class Item_splocal to
the class sp_instr_cursor_copy_struct and deallocated it explicitly on
closing the stored routine.
affd95c514e1...
affd95c514e160ade1a7294253df9692a672faea
Alexey Botchkov
MDEV-39750 ExtractValue does not control recursion depth.

    More stack needed here.
adc199427fc8...
adc199427fc8baa75c96f6ced0cdd4361aaeed2a
Sergei Golubchik
MDEV-40413 ALTER TABLE ... CONVERT ... PARTITION doesn't encode partition names

CONVERT ... PARTITION passed user-specified partition names to
create_partition_name() with translate=FALSE, so names needing
filename escaping (e.g. `foo-bar`) didn't match the on-disk file.
Pass TRUE to encode them.
abae5740203a...
abae5740203ac18f9c7b562bdcf6b0745e615e9f
Rex
MDEV-40465 table map consulted during setup fields on unfixed items

In setup_fields() we call item->update_used_tables() before split_sum_func
so that used_tables() is not consulted before the caches are set up on the
2nd execution of a prepared statement (fixes a 1st/2nd execution result
mismatch in main.subselect_nulls under --ps-protocol).

That recalculation exposes items whose caches are read while still being
(re)built, so add the guards it now depends on:
- Item_field::used_tables(): return 0 when field / field->table is not
  yet set, instead of dereferencing a null pointer.
- Item_direct_view_ref::used_tables(): return 0 when the item is not
  fixed yet, instead of asserting.
- Item_func::fix_fields(): reset used_tables_cache/const_item_cache at
  entry (assignment) instead of asserting they are already clear, so a
  re-fix is idempotent.

Remove select,ps.rdiff / select_jcl6,ps.rdiff / select_pkeycache,ps.rdiff:
the extra "resolved in SELECT #1" notes they recorded no longer appear
under --ps-protocol, so the select tests now match without an rdiff.
a54059b13a3f...
a54059b13a3fda8cbb5af4db7449d749b9946f9b
Alexey Botchkov
Another fix.
a397554fb7d8...
a397554fb7d845b474b99e11d79aff612e4d9727
Alexander Barkov
MDEV-40396 open SYS_REFCURSOR crash, if too many cursors

When THD::m_statement_cursor was resized by a call of alloc_dynamic,
the memory location of all sp_cursor::result changed.
Therefore all members "select_result *Server_side_cursor::select"
previously initialized in the constructor to addresses of
sp_cursor::result became invalid.

Fix:
- Removing the member "select_result *result;" from Server_side_cursor.
- Passing instead a new "select_result *" parameter to
  methods open() and fetch() of Server_side_cursor and its descendant
  Materialized cursor.

So now, for example, when sp_cursor::fetch() is called, it executes:

    server_side_cursor->fetch(&result/*new parameter*/, 1);

The address value `&result` is now always correct.
934108aab5cb...
934108aab5cb541b3fc09672b5d4090558ab408e
Vladislav Vaintroub
MDEV-14443 DENY statement

Implements DENY/REVOKE DENY and associated tasks.
91e823201b57...
91e823201b5728afd97e524bba41f6d8b2218e93
Alexey Botchkov
MDEV-39750 ExtractValue does not control recursion depth.

    More stack needed here.
90184d14d8eb...
90184d14d8eb89fa538392e03a557d9869fb026a
Rucha Deodhar
MDEV-40125: OLD_VALUE crashes on a view with an expression

Analysis:

When OLD_VALUE() is used on a view, field resolution creates an
Item_direct_view_ref instead of an Item_ref where real_item() points to the
expression. But Item_old_field::fix_fields() continues assuming that a Field
object was available, but view references do not have a field pointer,
which resulted in a crash.

Fix:
Store the real referenced item in Item_old_field::expr and use it when
the OLD_VALUE() reference does not have a Field object. This allows
OLD_VALUE() to work with view fields and avoids dereferencing a NULL
field pointer. Fix relevant methods accordingly.
8c8711771414...
8c8711771414cb1b440a5a7e10a71c11c3184e36
Rex Johnston
MDEV-26940 Item_cond::remove_eq_conds leaves corrupt Item_equal

pushdown_cond_for_derived/merge_into_list/remove_eq_conds leaves
an Item_equal in an invalid state.  This Item_equal is later used
by find_producing_item causing an assert in debug builds and perhaps
incorrect results in a release build. This Item_equal should no longer
be referred to, so rather than correct the Item_equal, we correct the
reference used later to look up our base table field.

Affected queries will likely have an outer condition pushed down into
2 different derived tables based on the same base table.
85ab366da3fc...
85ab366da3fc5d13b61d9e491e63e2b62c017cf4
Luke Lu
MDEV-39689: Fix OOB reads in Table_map_log_event parsing

Add bounds checks to prevent out-of-bounds memory reads when parsing
Table_map_log_event optional metadata and constructor fields.

The checks prevent OOB reads but do not attempt to throw errors for
every possible corruption. Replication fundamentally assumes a trusted
source with valid data. The goal here is hardening against accidental
corruption (truncated events, garbled metadata lengths). On detecting
corruption, the slave either falls back gracefully to positional column
mapping (parse_* functions) or rejects the event entirely (constructor),
rather than crashing or leaking heap contents via OOB reads.

parse_* functions: Add if (unlikely(p > end)) return after every
net_field_length() call. Ensures decoded values are validated before
being stored to struct fields, preventing information disclosure from
OOB reads. On early return, the slave gracefully falls back to
positional column mapping.

Table_map_log_event constructor: Add bounds checks before memcpy calls
for m_colcnt, m_field_metadata_size, and m_null_bits. On overflow, frees
allocated memory and sets m_memory=NULL causing is_valid() to return
false. Adds read-side DBUG_EXECUTE_IF injection points for testing.

Functions fixed:
- parse_default_charset
- parse_column_charset
- parse_column_name
- parse_set_str_value
- parse_geometry_type
- parse_simple_pk
- parse_pk_with_prefix
- Table_map_log_event constructor (m_colcnt, m_field_metadata, m_null_bits)

MTR test rpl_table_map_log_event_overflow covers all affected code paths
with 9 test cases using debug injection.
687794841554...
687794841554696037a03fd63ca6f24532431b1c
Vladislav Vaintroub
MDEV-14443 DENY statement

Implements DENY/REVOKE DENY and associated tasks.
680319ca3683...
680319ca3683f7278db4e0f2e911d9ac4b4ba72e
forkfun
new wolfssl v5.9.2-stable
635e24dbdfc9...
635e24dbdfc97ecd94a44b563bd3082075f97c49
Raghunandan Bhat
MDEV-40316: Infer: PULSE_RESOURCE_LEAK in connect

Problem:
  Infer found file descriptors left open on some error code paths in
  connect storage engine.

Fix:
  Close file descriptors on error before returning.
510a278866c1...
510a278866c126631e2a78bb1587f18384778739
Sergei Golubchik
apply reasonable limits to initid.max_length as provided by UDF

UDF can set max_length incorrectly, e.g. to 2138 for an integer.
let's cap UDF-provided value by a type-specific limit.
5070945320f4...
5070945320f4dccc74205450e2f959ed263100dd
bsrikanth-mariadb
MDEV-40384: innodb_gis.geometry fails on replay

The test had innodb_strict_mode turned OFF, when running the test. But,
in the replay, it was enabled, which caused the creation of tables with
KEY_BLOCK_SIZE=16 fail.

Solution is to record the innodb_strict_mode variable in the context, so
that it gets used during the replay.
473d41214405...
473d41214405190ecf88f21d42604136fc8484bf
Rucha Deodhar
MDEV-40125: OLD_VALUE crashes on a view with an expression

Analysis:

When OLD_VALUE() is used on a view, field resolution creates an
Item_direct_view_ref instead of an Item_ref where real_item() points to the
expression. But Item_old_field::fix_fields() continues assuming that a Field
object was available, but view references do not have a field pointer,
which resulted in a crash.

Fix:
Store the real referenced item in Item_old_field::expr and use it when
the OLD_VALUE() reference does not have a Field object. This allows
OLD_VALUE() to work with view fields and avoids dereferencing a NULL
field pointer. Fix relevant methods accordingly.
4388fccbd44f...
4388fccbd44f8db4ec34f0fb791e842d861934ff
Alexey Botchkov
one more fix.
4273f6187432...
4273f6187432091dc411e09215fb3a9a1ce42a22
Alexey Botchkov
MDEV-39750 ExtractValue does not control recursion depth.

Stack exhaustive test shouldn't be ran with the ASAN/UBSAN.
3ff8c1a937ac...
3ff8c1a937aca7e707ecd64f7c51f12e46c72649
Raghunandan Bhat
MDEV-38075: Make sysV init script check for actual function presence

Problem:
  The current implementation of the sysvinit script only creates
  `log_success_msg()` and `log_failure_msg()` fallback functions when
  not finding an /etc/init.d/functions file to include.

  Newer RHEL releases do not define those functions in that file
  anymore.

Fix:
  Check if the functions are defined and provide fallback functions if
  they are not defined.
265bf3a9b10d...
265bf3a9b10d064d14b7bfc702b47c51b8863962
Alexey Botchkov
MDEV-39750 ExtractValue does not control recursion depth.

Stack control added.
193ced9b843f...
193ced9b843f06f451988d1e61c0489ca099b64d
Hemant Dangi
MDEV-35812: Galera SST fails with TLS certificate containing an intermediate CA

Issue:
Verify_ca_matches_cert ran "openssl verify -CAfile <ca> <cert>", which
treats only the first cert in the file as the target. For a leaf+intermediate
bundle against a root-only CA, openssl cannot reach the root, so the check
aborts the SST (exit 22).

Solution:
Pass the cert file as -untrusted so bundled intermediates complete
the chain to the CA. Trust anchor is unchanged (still -CAfile only).
1693e0aedcae...
1693e0aedcae8e09972817db6235ab0a1b696125
Alexander Barkov
MDEV-39587 Package-wide TYPE for variable declarations

SET sql_mode=ORACLE;
DELIMITER $$
CREATE OR REPLACE PACKAGE pkg AS
  -- Declare a package public data type
  TYPE varchar_array IS TABLE OF VARCHAR(2000) INDEX BY INTEGER;
END;
$$
DELIMITER ;
DELIMITER $$

CREATE OR REPLACE PROCEDURE p1 AS
  v pkg.varchar_array; -- Use the package public data type
BEGIN
  v(0):='test';
  SELECT v(0);
END;
$$
DELIMITER ;

Note, the change is done only for sql_mode=ORACLE, because the TYPE
declaration is not available for the default mode.

Where package-wide types are available
--------------------------------------
- Variabe list type:
    DECLARE var pkg1.type1;

- RETURN type for a package routine:
    CREATE FUNCTION .. RETURN pkg1.type1 ...

- Parameter type for a package routine:
    PROCEDURE p1(param1 pkg1.type1);

- Assoc array element type:
    TYPE assoc1_t IS TABLE OF pkg1.type1 ...

- REF CURSOR RETURN type:
    TYPE cur1_t IS REF CURSOR RETURN pkg1.type1;

Change details
--------------

- Adding a member Lex_length_and_dec_st::m_foreign_module_type
  It's set to true when the data type was initialized from a TYPE
  in foreign routine (e.g. in PACKAGE spec).
  It's needed to prevent use of qualified identifiers in public contexts,
  i.e. in schema public routine parameter types and schema publuc function
  RETURN types.
  Adding a helper method sp_head::check_applicability() which prevents
  use of qualified types in public context.

- Adding a helper method sp_head::raise_unknown_data_type().

- Adding methods LEX::set_field_type_typedef_package_spec() for
  2-step and 3-step qualified indentifiers.
  It's used in field_type_all_with_typedefs which covers cases:
  - Variabe list type        : DECLARE var pkg1.type1;
  - RETURN type              : CREATE FUNCTION .. RETURN pkg1.type1 ...
  - Parameter type          : PROCEDURE p1(param1 pkg1.type1);
  - Assoc array element type : TYPE assoc1_t IS TABLE OF pkg1.type1 ...

- Adding a method LEX::declare_type_ref_cursor_return_typedef().
  It handles cases when a new TYPE REF CURSOR RETURN is declared,
  for both for qualified RETURN types and non-qualified RETURN types:
  - TYPE cur0_t IS REF CURSOR RETURN rec1_t;
  - TYPE cur0_t IS REF CURSOR RETURN pkg1.rec1_t;
  - TYPE cur0_t IS REF CURSOR RETURN db1.pkg1.rec1_t;

  The code was moved from LEX::declare_type_ref_cursor() into
  LEX::declare_type_ref_cursor_return_typedef() and extended
  to cover qualified RETURN types.

- Adding a method Sql_path::find_package_spec_type().
  It iterates through all schemas specified in @@path and searches
  for the given type in the given package.

- Adding a helper method sp_pcontext::type_defs_add_ref_cursor()
  to reuse the code.

- Adding a new method sp_package::get_typedef() to search
  for TYPE definitions in PACKAGE specifications.

- Adding a new method sp_head::get_typedef_package_spec()
  to search for TYPE definitions used by a PROCEDURE or FUNCTION.

- Adding a helper method
    Sp_handler::sp_cache_routine_reentrant_suppress_errors
  Adding a method Sp_handler::find_package_spec().
1157c5f08aaf...
1157c5f08aaf75798e019d1991dc04e47e24b110
Alessandro Vetere
MDEV-40408 btr_page_reorganize_low() uses the buffer pool just to obtain a scratch block

Add a pool of scratch blocks, btr_scratch_pool_t, to be used instead
of the global buffer pool in the page-reorganization operations,
when a scratch block is needed.
Removes the needs of obtaining the buf_pool.mutex in such functions,
and any delay while holding at least page X-latch that it might have
caused.
1091393160c1...
1091393160c1f8e29a3f0605795b1c82ea27c10d
Vladislav Vaintroub
MDEV-37000 disable optimization for Aria remove_key() on affected MSVC

The Aria remove_key() helper can miscompile in x64 MSVC builds when
optimization is enabled, leading to 'Index is corrupt' during DELETE.

Apply the same #pragma optimize("g", off) workaround already used in
MyISAM, and limit it to _MSC_VER >= 1930 && _MSC_VER < 1951.

The upper bound for affected MSVC is just the newest MSVC version in
VS2026, where the bug is no longer reproducible. Also, MSVC release notes
https://learn.microsoft.com/en-us/visualstudio/releases/2026/release-notes
list multiple fixes for 19.50 x64 optimizer and codegen bugs.
0c2c9081d56b...
0c2c9081d56b2aee61ce587d4a1167a8eb100042
Rex
MDEV-35673 Correlated subquery problems causing wrong results and server crash

Split from MDEV-32294, discovered while inspecting how
Item_subselect::used_tables_cache is recalculated across the 1st and 2nd
executions of a prepared statement.

Core name-resolution / used_tables rework:
- Maintain SELECT_LEX::outer_references_resolved_here, a statement-memory
  list of the outer references resolved in each select_lex (relies on
  MDEV-30073 so these are not freed at end of PS execution), and rewrite
  Item_subselect::recalc_used_tables() to compute used_tables_cache from
  it (Item_belongs_to + Field_fixer).
- Preserve Item_field::depended_from across executions and use it in
  fix_fields/fix_outer_field instead of re-running fix_outer_field, so
  2nd-execution resolution is stable.
- Maintain nest_level/nest_level_base and merged_into during derived and
  semi-join merges, and update outer_references_resolved_here when a
  subquery is merged into its parent.

find_field_in_tables: wrap a HAVING outer reference in an Item_ref during
name resolution (previously done only in Item_field::fix_outer_field),
fixing a marked_for_read() assertion on queries such as
  SELECT 1 FROM (SELECT a FROM t1) b HAVING (SELECT b.a)=1

create_view_field: resolve view-field substitutions against
current_select and allocate them on statement memory.

Ban EXPLAIN EXTENDED under the mtr --ps-protocol (warning output differs
because some select_transformers do not run during PREPARE).

Tests: introduce main.outer_reference with ~90 labelled cases and the
execute_various_ways.inc harness, which runs each query six ways (direct,
prepare+execute twice, derived table, view, CTE, stored procedure) and,
via include/evw_capture.inc, cross-checks that all six return identical
rows.
BuildBot (0.8.9) working for the MariaDB project.
Page built: Tue 21 Jul 2026 04:27:34 (UTC)