Home - Waterfall Grid T-Grid Console Builders Recent Builds Buildslaves Changesources - JSON API - About

Console View


Categories: connectors experimental galera main
Legend:   Passed Failed Warnings Failed Again Running Exception Offline No data

connectors experimental galera main
Georg Richter
CONC-847: Fix OOB read in unpack_fields() on truncated metadata packet

When processing server field packets in unpack_fields(), the 12-byte
binary metadata envelope starting at row->data[i] (containing charsetnr,
display length, field type, flags, decimals, and filler bytes) is read
without validating that row->data[i] stays within row->length.

A malformed or truncated field packet sent by a server/proxy can cause
row->data[i] to point near or beyond row->length, resulting in an
Out-of-Bounds (OOB) read when unpacking binary field metadata.

Fix this by introducing a strict boundary check verifying that at least
12 bytes remain in the row buffer starting from row->data[i] before
unpacking metadata fields. If the check fails, unpack_fields() fails
gracefully, sets CR_MALFORMED_PACKET, and returns NULL.

Also add unit tests (test_conc847_valid and test_conc847_invalid) covering
both standard field packet parsing and truncated OOB packet handling.
  • cc-x-codbc-windows: 'dojob pwd if '3.4' == '3.4' ls win32/test SET TEST_DSN=master SET TEST_DRIVER=master SET TEST_PORT=3306 SET TEST_SCHEMA=odbcmaster if '3.4' == '3.4' cd win32/test if '3.4' == '3.4' ctest --output-on-failure' failed -  stdio
Georg Richter
Fix build error
Georg Richter
Merge branch '3.3-security' into 3.3
  • cc-x-codbc-windows: 'dojob pwd if '3.4' == '3.4' ls win32/test SET TEST_DSN=master SET TEST_DRIVER=master SET TEST_PORT=3306 SET TEST_SCHEMA=odbcmaster if '3.4' == '3.4' cd win32/test if '3.4' == '3.4' ctest --output-on-failure' failed -  stdio
Georg Richter
CONC-846: Fix TLS verification check during auth-switch and certificate options logic
Two issues resolved in TLS verification logic:

1. In run_plugin_auth(), the verification guard previously evaluated:
  (mysql->net.tls_verify_status & MARIADB_TLS_VERIFY_TRUST)

  This allowed non-hashing plugins (e.g. mysql_clear_password) to execute
  when only hostname verification failed (MARIADB_TLS_VERIFY_HOST = 2),
  because (2 & 1) evaluated to 0. Updated the check to evaluate any non-zero
  tls_verify_status, ensuring all verification failures block cleartext
  auth switches.

2. Fixed TLS verification enabling when ssl_ca or crl options are specified
  even if MYSQL_OPT_SSL_VERIFY_SERVER_CERT (MARIADB_OPT_TLS_VERIFY_SERVER_CERT)
  was explicitly disabled. Certificate authority files/CRLs are now correctly
  honored and loaded according to caller intent.
  • cc-x-codbc-windows: 'dojob pwd if '3.4' == '3.4' ls win32/test SET TEST_DSN=master SET TEST_DRIVER=master SET TEST_PORT=3306 SET TEST_SCHEMA=odbcmaster if '3.4' == '3.4' cd win32/test if '3.4' == '3.4' ctest --output-on-failure' failed -  stdio
Michal Schorm
CONC-818 report CR_SERVER_LOST on TLS connection close (#308)

When the server closes a connection, ma_tls_read() in the
OpenSSL and GnuTLS plugins unconditionally calls
ma_tls_set_error(), which sets CR_SSL_CONNECTION_ERROR.
The caller ma_net_safe_read() then preserves that error
code instead of reporting the correct CR_SERVER_LOST.

The Schannel plugin already handles this correctly:
it returns 0 on SEC_I_CONTEXT_EXPIRED without setting
any TLS error (schannel.c:640-642).

Apply the same logic to OpenSSL and GnuTLS.  Detect
connection close and return 0 without setting error:

OpenSSL:
- SSL_ERROR_ZERO_RETURN: orderly close (close_notify)
- SSL_ERROR_SYSCALL with empty error queue: EOF without
  close_notify (OpenSSL 1.x)
- SSL_ERROR_SSL with SSL_R_UNEXPECTED_EOF_WHILE_READING:
  same EOF, reported differently by OpenSSL 3.x

GnuTLS:
- rc == 0: orderly close (close_notify)
- GNUTLS_E_PREMATURE_TERMINATION: EOF without
  close_notify (GnuTLS 3.7.4+)

Co-authored-by: Claude AI <[email protected]>
Sergei Golubchik
cleanup: ma_hashtbl_init, typos, mutex lock in ma_tls_end()

ma_hashtbl_init with CALLER_INFO was copied from the server, but
never used here (CALLER_INFO wasn't even defined)

the locking the mutex just before destroying is
fundamentally broken, let's not do it.
Georg Richter
Fix leak in test_conc847_valid
  • cc-x-codbc-windows: 'dojob pwd if '3.4' == '3.4' ls win32/test SET TEST_DSN=master SET TEST_DRIVER=master SET TEST_PORT=3306 SET TEST_SCHEMA=odbcmaster if '3.4' == '3.4' cd win32/test if '3.4' == '3.4' ctest --output-on-failure' failed -  stdio
Georg Richter
Fix OOB read in init_read_hdr() via dynamic column header validation

In mariadb_dyncol.c, init_read_hdr() computed header pointer offsets
and hdr->data_size without validating that the sum of fixed_hdr,
header_size, and nmpool_size fit within str->length.

Crafted dynamic column blobs with invalid metadata could push pointer
offsets past the buffer bounds or cause unsigned integer underflow on
hdr->data_size, leading to out-of-bounds reads in downstream functions.

Add bounds check in init_read_hdr() to ensure header offsets do not
exceed total buffer length, matching mariadb_dyncol_check().

Reported-by: AISLE Research
  • cc-x-codbc-windows: 'dojob pwd if '3.4' == '3.4' ls win32/test SET TEST_DSN=master SET TEST_DRIVER=master SET TEST_PORT=3306 SET TEST_SCHEMA=odbcmaster if '3.4' == '3.4' cd win32/test if '3.4' == '3.4' ctest --output-on-failure' failed -  stdio
Georg Richter
Merge branch '3.3' into 3.4
Georg Richter
Fix potential OOM vulnerability via oversized column counts

A malicious proxy or Man-in-the-Middle (MitM) could inject a large length-encoded
integer for the result set field count. Untrusted column counts could trigger
excessive memory allocation in the client, leading to an Out-Of-Memory
crash.

To prevent this, restrict the maximum allowed column count per result set via
a new option `MARIADB_OPT_MAX_COLUMNS`, defaulting to MAX_RESULT_COLUMNS (65,535).

If a server or proxy sends a field count exceeding this threshold:
1. Reject the packet immediately before allocation.
2. Raise CR_ERR_TOO_MUCH_COLUMNS (5027).
3. Set `mysql->net.error = 2` to prevent subsequent commands from reading
  desynchronized buffer state.
sunhaiyong1978
Use CMAKE_SIZEOF_VOID_P EQUAL 8 for 64-bit detection (#318)

Use CMAKE_SIZEOF_VOID_P EQUAL 8 for 64‑bit detection instead of
maintaining an architecture list. This is cleaner and more maintainable.
Georg Richter
Fix copy/paste error, introduced by rev. a7072b5bf0907c38bacf928ea3ee839314e379c6
Nikita Malyavin
Fix ninja build for DEB layout (#302)

In DEB layout, mariadbclient is named libmariadb.a

In install.cmake:
SET(LIBMARIADB_STATIC_DEB "mariadb")

This causes a duplicate target for libmariadb.a, and moreover,
a symlink recipe with reference to already existing file.

Make builds don't report a dupliate problem, and besides,
"file already exists" is not reported somehow.
Ninja build reports error.

The only check that has to be done is comparison
against INSTALL_LAYOUT, because LIBMARIADB_STATIC_NAME
is unconditionally set to the layout's value:
SET(LIBMARIADB_STATIC_NAME ${LIBMARIADB_STATIC_${INSTALL_LAYOUT}})
Georg Richter
Adjust default MAX_RESULT_COLUMNS to 0xFFFFF

The previous default threshold of 0xFFFF (65,535) broke legitimate server
tests and queries with high column counts (e.g., Bug #19216 with 68,001
columns).
Georg Richter
Changed the error message back to avoid failing tests
Georg Richter
Merge branch '3.3' into 3.4
  • cc-x-codbc-windows: 'dojob pwd if '3.4' == '3.4' ls win32/test SET TEST_DSN=master SET TEST_DRIVER=master SET TEST_PORT=3306 SET TEST_SCHEMA=odbcmaster if '3.4' == '3.4' cd win32/test if '3.4' == '3.4' ctest --output-on-failure' failed -  stdio
Georg Richter
CONC-842: Fix heap buffer over-read in mthd_my_read_rows

A security vulnerability was identified in mthd_my_read_rows() where incoming
field length prefixes ('len') were validated only against the destination buffer
boundary ('end_to'), but not against the remaining source network packet buffer
('end_cp').

Because 'end_to' includes additional slack allocation bytes intended for field
NUL-terminators, a crafted packet with an inflated field length could bypass
destination checks, causing memcpy() to read out-of-bounds memory past 'end_cp'.

Fix this by introducing two validation steps:
1. Pre-check (cp >= end_cp): If the network buffer is exhausted before reading
  a field length byte (e.g. 8-field packet with fields = 9 due to extended
  type info), safely set remaining field pointers to NULL without reading
  out-of-bounds or throwing CR_MALFORMED_PACKET.
2. Post-check (len > end_cp - cp): Verify 'len' does not exceed remaining
  source packet bytes before executing memcpy(). Abort with
  CR_MALFORMED_PACKET if exceeded.
Georg Richter
Merge branch '3.3' into 3.4-tmp
  • cc-x-codbc-windows: 'dojob pwd if '3.4' == '3.4' ls win32/test SET TEST_DSN=master SET TEST_DRIVER=master SET TEST_PORT=3306 SET TEST_SCHEMA=odbcmaster if '3.4' == '3.4' cd win32/test if '3.4' == '3.4' ctest --output-on-failure' failed -  stdio
Georg Richter
Cleanup for test: drop my_vector table
Georg Richter
Add support for MYSQL_TYPE_VECTOR in ps protocol.

Added support for MYSQL_TYPE_VECTOR. Since MariaDB server doesn't
know MYSQL_TYPE_VECTOR we convert parameter types to MYSQL_TYPE_BLOB.

This commit also fixes a crash if an unknown field type was sent
from server.
  • win-connector_c_3: 'dojob cd win32 && del CMakeCache.txt && cmake --version && cmake ..\src -G "Visual Studio 17 2022" -A "Win32" -DCMAKE_BUILD_TYPE=RelWithDebInfo -DWITH_SSL=SCHANNEL -DWITH_MSI=ON -DCURL_INCLUDE_DIR=c:\tools\curl\include && cmake --build . --clean-first --config RelWithDebInfo --target package' failed -  stdio
Georg Richter
Fix ps.c test:

Declare constant numbers as float to avoud float to double
conversion warning/errors
  • cc-x-codbc-windows: 'dojob pwd if '3.4' == '3.4' ls win32/test SET TEST_DSN=master SET TEST_DRIVER=master SET TEST_PORT=3306 SET TEST_SCHEMA=odbcmaster if '3.4' == '3.4' cd win32/test if '3.4' == '3.4' ctest --output-on-failure' failed -  stdio
Georg Richter
Revert "Remove length checks in mthd_stmt_fetch_to_bind, keep only the sentinel"

This reverts commit 47a31a98750fd7c805ba67414c6d3df787ce8b2c.
  • cc-x-codbc-windows: 'dojob pwd if '3.4' == '3.4' ls win32/test SET TEST_DSN=master SET TEST_DRIVER=master SET TEST_PORT=3306 SET TEST_SCHEMA=odbcmaster if '3.4' == '3.4' cd win32/test if '3.4' == '3.4' ctest --output-on-failure' failed -  stdio
Sergei Golubchik
MDEV-40445 TLS session resumption

in fact it was already on in the server, so this only
enables statistics to see it in SHOW STATUS, adds tests,
and updates C/C to match.

Assisted-By: Claude:claude-5-opus
Georg Richter
Merge branch '3.4-security' into 3.4
  • cc-x-codbc-windows: 'dojob pwd if '3.4' == '3.4' ls win32/test SET TEST_DSN=master SET TEST_DRIVER=master SET TEST_PORT=3306 SET TEST_SCHEMA=odbcmaster if '3.4' == '3.4' cd win32/test if '3.4' == '3.4' ctest --output-on-failure' failed -  stdio
Georg Richter
Merge branch '3.3' into 3.4
  • cc-x-codbc-windows: 'dojob pwd if '3.4' == '3.4' ls win32/test SET TEST_DSN=master SET TEST_DRIVER=master SET TEST_PORT=3306 SET TEST_SCHEMA=odbcmaster if '3.4' == '3.4' cd win32/test if '3.4' == '3.4' ctest --output-on-failure' failed -  stdio
Georg Richter
Merge branch '3.3' into 3.4
  • cc-x-codbc-windows: 'dojob pwd if '3.4' == '3.4' ls win32/test SET TEST_DSN=master SET TEST_DRIVER=master SET TEST_PORT=3306 SET TEST_SCHEMA=odbcmaster if '3.4' == '3.4' cd win32/test if '3.4' == '3.4' ctest --output-on-failure' failed -  stdio
Georg Richter
Infer fixes for replication/binlg API
  • cc-x-codbc-windows: 'dojob pwd if '3.4' == '3.4' ls win32/test SET TEST_DSN=master SET TEST_DRIVER=master SET TEST_PORT=3306 SET TEST_SCHEMA=odbcmaster if '3.4' == '3.4' cd win32/test if '3.4' == '3.4' ctest --output-on-failure' failed -  stdio
Georg Richter
CONC-843: Backport fix for crash from 3.4 branch

If an unknown type was returned from server (e.g. MYSQL_TYPE_VECTOR)
client has to throw an error instead of crashing
Michal Schorm
CONC-817: CMake cleanup: fix variable quoting bugs, remove dead code (#307)

* CONC-817 Remove redundant nested IF(MSVC) conditional

The outer IF(MSVC) at line 108 already guards this block.
The inner IF(MSVC) at line 112 is therefore always true and
adds an unnecessary indentation level.  Remove it and dedent
the enclosed FOREACH loops that adjust MSVC compiler flags
(/MD->/MT, /Zi->/Z7).

The redundant nesting has been present since the MSVC flag
handling was first added.  It appears to be a copy-paste
artifact — possibly the inner block was moved inside the
outer IF(MSVC) without removing its own guard.

Co-Authored-By: Claude AI <[email protected]>

* CONC-817 Fix CMake variable quoting in conditionals

Fix four unquoted variable expansions in IF() conditions:

1. Quote ${IS_SO} in STREQUAL (mariadb_config/CMakeLists.txt).
  STRING(FIND) stores an integer index in IS_SO. When used
  unquoted in IF(NOT ${IS_SO} STREQUAL "-1"), CMake expands
  the value bare into the condition, which can mis-parse if
  the value is empty or contains characters CMake treats
  specially.  Quoting as "${IS_SO}" is the standard idiom.

2. Quote ${LIB_PREFIX} in STREQUAL (mariadb_config/CMakeLists.txt).
  Same pattern as IS_SO — STRING(SUBSTRING) result used
  unquoted in a STREQUAL comparison.

3. Use explicit dereference for ${v}_FILE_VERSION in MATCHES
  (CMakeLists.txt).  The original IF(NOT ${v}_FILE_VERSION
  MATCHES ...) expands ${v} to form a bare variable name and
  relies on CMake's auto-dereference.  Using the explicit
  form "${${v}_FILE_VERSION}" is equivalent, but safer
  against values that coincide with CMake keywords, and
  more readable as intent.

4. Fix unquoted boolean test of CC_TARGET_COMPILE_OPTIONS
  (cmake/plugins.cmake).  if(${CC_TARGET_COMPILE_OPTIONS})
  expands the value into the condition, which breaks when the
  value is a multi-word list.  Use the bare variable name
  if(CC_TARGET_COMPILE_OPTIONS) which correctly tests whether
  the variable is defined and non-empty.
  Note: CC_TARGET_COMPILE_OPTIONS is currently never set
  anywhere (introduced in 50d48e91, likely a typo for
  CC_PLUGIN_COMPILE_OPTIONS, which is already applied via
  COMPILE_FLAGS on the same target).  The block is preserved
  in case a caller populates this variable in the future.

Co-Authored-By: Claude AI <[email protected]>

* CONC-817 Fix ZLIB_LIBRARY (singular) to ZLIB_LIBRARIES

Replace ${ZLIB_LIBRARY} with ${ZLIB_LIBRARIES} in two places:
- CMakeLists.txt:    CMAKE_REQUIRED_LIBRARIES list
- libmariadb/CMakeLists.txt: SYSTEM_LIBS list

CMake's standard FindZLIB module provides ZLIB_LIBRARIES
(plural), not ZLIB_LIBRARY (singular).  The singular form is
never set by FindZLIB, so in a standalone connector-c build
the variable is always empty, silently dropping zlib from the
link and check-library lists.

The server currently works around this in cmake/zlib.cmake
with an explicit compatibility shim:
  # temporarily define ZLIB_LIBRARY ... for libmariadb
  SET(ZLIB_LIBRARY ${ZLIB_LIBRARIES})
which masks the bug in subproject builds.

Other uses within connector-c already use the correct plural
form (CMakeLists.txt:241 in SYSTEM_LIBS, and line 353 in
SSL_LIBRARIES).  This commit makes the remaining two sites
consistent, and allows the server to eventually drop its
ZLIB_LIBRARY compatibility shim.

Co-Authored-By: Claude AI <[email protected]>

* CONC-817 Remove dead ADD_DEFINITIONS(LIBMARIADB_PLUGIN_DEFS)

Remove ADD_DEFINITIONS(${LIBMARIADB_PLUGIN_DEFS}) from
libmariadb/CMakeLists.txt.  The variable LIBMARIADB_PLUGIN_DEFS
is never set anywhere.

The REGISTER_PLUGIN function in cmake/plugins.cmake (introduced
in 50d48e91, "Reworked plugin interface", 2018) populates four
PARENT_SCOPE variables for static plugin integration:
  LIBMARIADB_PLUGIN_SOURCES  (line 101)
  LIBMARIADB_PLUGIN_LIBS    (line 102)
  LIBMARIADB_PLUGIN_INCLUDES (line 100)
  LIBMARIADB_PLUGIN_CFLAGS  (line 99)
but never LIBMARIADB_PLUGIN_DEFS.  No other code in the
connector-c or mariadb-server repositories sets this variable.

The ADD_DEFINITIONS() call with an empty expansion is a no-op
and has been dead since the plugin interface rework.

Co-Authored-By: Claude AI <[email protected]>

* CONC-817 Remove dead LIBBIND references

Remove ${LIBBIND} from CMAKE_REQUIRED_LIBRARIES and SYSTEM_LIBS
lists in CMakeLists.txt.  The variable is never populated.

LIBBIND was originally set by SEARCH_LIBRARY(LIBBIND bind
"bind;socket"), added in ab240328 (2013, "Fixes for Solaris
build — CONC-36,37,38") to find the bind/socket library on
Solaris.  The SEARCH_LIBRARY call was removed in 97a6aeaf
(2016, "Fixed build errors for remote_io plugin"), but the
two references in the library lists were accidentally left
behind.

The variable has been expanding to empty for 10 years.

Co-Authored-By: Claude AI <[email protected]>

* CONC-817 Remove dead PLUGINS_OFF variable

Remove the accumulation of disabled plugin names into the
PLUGINS_OFF variable in cmake/plugins.cmake.

PLUGINS_OFF was introduced in 50d48e91 (2018, "Reworked plugin
interface") alongside PLUGINS_DYNAMIC, PLUGINS_STATIC, and
PLUGINS_DISABLED.  The latter three are all exported via
PARENT_SCOPE and consumed by calling code.  PLUGINS_OFF,
however, is set without PARENT_SCOPE (making it local to
the REGISTER_PLUGIN function call) and is never read anywhere
in the connector-c or mariadb-server repositories.

For comparison, PLUGINS_DISABLED (line 49) correctly uses
PARENT_SCOPE.  PLUGINS_OFF appears to have been a leftover
from development that was never wired up.

Co-Authored-By: Claude AI <[email protected]>

* CONC-817 Remove dead PLUGIN_EXTRA_FILES variable

Remove SET(PLUGIN_EXTRA_FILES ...) from plugins/CMakeLists.txt.
The variable is set to ${CC_SOURCE_DIR}/libmariadb/ma_errmsg.c
but is never referenced anywhere in the connector-c or
mariadb-server repositories.

Introduced in aabaac04 ("Plugin fixes — include ma_errmsg.h if
plugin is built dynamically"), the variable appears to have
been intended to track extra source files needed by plugins.
However, it was never wired into any add_library or
target_sources call.  The file ma_errmsg.c is already compiled
into libmariadb directly via libmariadb/CMakeLists.txt:301,
and plugins link against libmariadb at runtime, so there is no
need to compile it separately into each plugin.

Co-Authored-By: Claude AI <[email protected]>

* CONC-817 Remove dead GSSAPI_FLAVOR_MIT variable

Remove set(GSSAPI_FLAVOR_MIT) from cmake/FindGSSAPI.cmake.
The statement sets the variable to empty (no value argument)
and it is never referenced anywhere.

The module was imported from libgit2 in 279e6a58 ("Use
FindGSSAPI.cmake from libgit2, rather than the one from KDE").
The GSSAPI_FLAVOR_MIT line appears to be a leftover from the
libgit2 module — it may have originally been a boolean flag
that was replaced by the string-valued GSSAPI_FLAVOR variable
(set to "MIT" or "HEIMDAL" on the lines immediately following).

Only GSSAPI_FLAVOR (without _MIT suffix) is used subsequently:
it is cached at line 116 and tested in CMakeLists.txt for
GSSAPI library selection.

Co-Authored-By: Claude AI <[email protected]>

* CONC-817 Remove commented-out CLIENT_DOCS install block

Remove the 5-line commented-out CLIENT_DOCS install block from
CMakeLists.txt.

History:
- Added in 98aad385 (2014, Georg Richter) as part of
  documentation installation support.
- Integrated into the server build output in 7a787b1e (2016).
- Commented out in 17f2d1fe (2024, Oleksandr Byelkin, "Revert
  'Fixed build of manpages'") when the documentation build
  infrastructure was reverted.

The CLIENT_DOCS variable is no longer set anywhere in the
codebase.  Documentation installation is now handled via
ADD_SUBDIRECTORY(man) on the line immediately below.
The commented block cannot execute and serves no reference
purpose since the documentation system it was part of has
been fully replaced.

Co-Authored-By: Claude AI <[email protected]>

* CONC-817 Remove duplicate zlib source/include block

Remove the first of two near-identical IF(ZLIB_FOUND AND
WITH_EXTERNAL_ZLIB) blocks from libmariadb/CMakeLists.txt
(formerly lines 171-192), keeping only the second block
(now around line 340) which is the functional one.

Both blocks define the same ZLIB_SOURCES list and call
INCLUDE_DIRECTORIES for the bundled zlib path.  However
block 1 never adds ZLIB_SOURCES to LIBMARIADB_SOURCES and
never applies the MSVC -W0 warning suppression — so the
source list it defines is immediately discarded (overwritten
by block 2).  Only its INCLUDE_DIRECTORIES call had any
effect.

Block 2 is the functional implementation: it defines
ZLIB_SOURCES, applies MSVC flags, appends to
LIBMARIADB_SOURCES, and sets include directories.

The removed block's include path included both
${CC_SOURCE_DIR}/external/zlib and
${CC_BINARY_DIR}/external/zlib.  The latter was not present
in block 2 — this commit adds it to preserve the include path
for any generated zlib headers (e.g. zconf.h) in the build
tree.

Note: block 2 still uses ${CMAKE_SOURCE_DIR} instead of
${CC_SOURCE_DIR} for the source include path — a known issue
that will be addressed separately, as fixing it requires
verifying no breakage in the server subproject build.

Co-Authored-By: Claude AI <[email protected]>

---------

Co-authored-by: Claude AI <[email protected]>
Co-authored-by: Georg Richter <[email protected]>
Georg Richter
Fix maxcolumns test
Georg Richter
CONC-820: Clamp server-provided field lengths to maximum bounds
  • cc-x-codbc-windows: 'dojob pwd if '3.4' == '3.4' ls win32/test SET TEST_DSN=master SET TEST_DRIVER=master SET TEST_PORT=3306 SET TEST_SCHEMA=odbcmaster if '3.4' == '3.4' cd win32/test if '3.4' == '3.4' ctest --output-on-failure' failed -  stdio
Georg Richter
Revert "Remove length checks in mthd_stmt_fetch_to_bind, keep only the sentinel"

This reverts commit 47a31a98750fd7c805ba67414c6d3df787ce8b2c.
  • cc-x-codbc-windows: 'dojob pwd if '3.4' == '3.4' ls win32/test SET TEST_DSN=master SET TEST_DRIVER=master SET TEST_PORT=3306 SET TEST_SCHEMA=odbcmaster if '3.4' == '3.4' cd win32/test if '3.4' == '3.4' ctest --output-on-failure' failed -  stdio
Sergei Golubchik
MDEV-40445 TLS session resumption

* needs no application changes
* connector keeps a hash of connection key -> sessions and resumes
  sessions automatically when applicable
* session key includes everything that affects cert verification
  (because resumed session is not re-verified)
* openssl and gnutls support only, not schannel

Assisted-By: Claude:claude-5-opus
rusher
[CONC-786] add infer to CI
Alexey Yurchenko
Merge branch '10.11' into MDEV-38147-missing-result-file
Georg Richter
CONC-838: Fix PBKDF2 CPU stall vulnerability in parsec auth plugin

A rogue or compromised server sending a high PBKDF2 iteration factor
in the parsec authentication plugin could cause the client to stall
for an extended period, leading to CPU exhaustion.

Fix this by dynamically calculating the maximum allowable iteration
factor (`max_iter_factor`) based on the configured connection timeout
(`connect_timeout`).

- Added `PBKDF2_ROUNDS_PER_MS` constant based on benchmark metrics to
  derive maximum rounds permitted within the connect timeout window.
  • cc-x-codbc-windows: 'dojob pwd if '3.4' == '3.4' ls win32/test SET TEST_DSN=master SET TEST_DRIVER=master SET TEST_PORT=3306 SET TEST_SCHEMA=odbcmaster if '3.4' == '3.4' cd win32/test if '3.4' == '3.4' ctest --output-on-failure' failed -  stdio
Georg Richter
Merge branch '3.3' into 3.4
  • cc-x-codbc-windows: 'dojob pwd if '3.4' == '3.4' ls win32/test SET TEST_DSN=master SET TEST_DRIVER=master SET TEST_PORT=3306 SET TEST_SCHEMA=odbcmaster if '3.4' == '3.4' cd win32/test if '3.4' == '3.4' ctest --output-on-failure' failed -  stdio
Mohammad Tafzeel Shams
MDEV-39795: Assertion `n_reserved > 0' failed

Problem:
========

1. Assertion `n_reserved > 0` failed in fseg_create():

fsp_reserve_free_extents() has a special condition for small
tablespaces where it reserves individual pages instead of full
extents. In such cases, n_reserved can be 0 even when the
reservation succeeds, causing the assertion ut_ad(n_reserved > 0)
to fail incorrectly.

The code was checking n_reserved to determine whether a reservation
had already been attempted, but this logic breaks for small
tablespaces where pages, rather than extents, are reserved.

2. Encryption metadata not cleared for compressed-only pages:

buf_page_encrypt() only cleared encryption-related metadata
fields (key-version and crypt-checksum) when the page was
neither encrypted nor compressed. However, these fields should
also be cleared when page_compressed is true but encrypted is
false, to avoid leaving stale encryption metadata in
compressed-only pages.

Solution:
=========

buf_page_encrypt(): Refactored the early-return logic. Encryption
metadata fields are now cleared whenever encrypted is false,
regardless of page_compressed. The function returns early only
when both !encrypted and !page_compressed.

fseg_create(): Reintroduced a boolean variable `reserved` to track
whether fsp_reserve_free_extents() has been attempted (removed as
part of MDEV-38419 | c7313da), replacing assertion `n_reserved > 0`.
Added an early return when DB_DECRYPTION_FAILED is encountered
during inode allocation.

my_error_innodb(): Added handling for DB_DECRYPTION_FAILED to
report decryption errors to the user through ER_GET_ERRMSG.
Georg Richter
Added missing .inferconfig
  • cc-x-codbc-windows: 'dojob pwd if '3.4' == '3.4' ls win32/test SET TEST_DSN=master SET TEST_DRIVER=master SET TEST_PORT=3306 SET TEST_SCHEMA=odbcmaster if '3.4' == '3.4' cd win32/test if '3.4' == '3.4' ctest --output-on-failure' failed -  stdio
Georg Richter
Infer fixes for replication/binlg API
  • cc-x-codbc-windows: 'dojob pwd if '3.4' == '3.4' ls win32/test SET TEST_DSN=master SET TEST_DRIVER=master SET TEST_PORT=3306 SET TEST_SCHEMA=odbcmaster if '3.4' == '3.4' cd win32/test if '3.4' == '3.4' ctest --output-on-failure' failed -  stdio