Home - Waterfall Grid T-Grid Console Builders Recent Builds Buildslaves Changesources - JSON API - About

Console View


Categories: connectors experimental galera main
Legend:   Passed Failed Warnings Failed Again Running Exception Offline No data

connectors experimental galera main
f397814cb2cc...
f397814cb2cc8bdc1ccaa60d84dd0baef60c38ea
bsrikanth-mariadb
MDEV-41749: FederatedX pushdown sends "<nop>(" in pushed-down SQL

A pushed-down statement containing "x < SOME (subquery)" failed on the
remote server with a syntax error, as the query text contained the
internal "<nop>(...)" wrapper. "x < ALL (subquery)" is wrapped in
"<not>(...)" in the same way.

Item_func_not_all::print() prints the wrapper whenever `show` is set.
Omit it when QT_PARSABLE is requested, and print the original
"x op ALL|ANY (subquery)" in parentheses, so that a parent expression
keeps the correct precedence.

Add tests to federatedx_pushdown_upd_del covering SOME and ALL in
UPDATE, DELETE and multi-table SELECT.
e0cd1593893a...
e0cd1593893ab57ffb81813da5f7896c0e04e96c
Kristian Nielsen
Merge branch 'knielsen_fixes_10.11' 10.11
d9cf2a3aed49...
d9cf2a3aed497ea1e3697c0974263b952f0fc1aa
Vladislav Vaintroub
MDEV-41800 Remove comment

Assisted-by: Claude:claude-sonnet-5-5
d551915cc929...
d551915cc929fac9a15ae679f82719cf2744dc2a
Sergei Golubchik
MDEV-41803 mariadb-binlog --raw takes the output file name from Rotate events without checking it

mariadb-binlog --raw appended the file name from a Rotate event to the
--result-file prefix, so a malicious server could make it write files
outside that directory.

Reject a Rotate event file name with a directory component - a
legitimate server only puts a bare file name in the Rotate event

Assisted-by: Claude:claude-opus-5-5
d0df3441dac7...
d0df3441dac74657a9ce0b66374a9b4308bdbd3a
Vladislav Vaintroub
MDEV-41800 Flush stdout after mysqld --help

Under load on Windows, the last partial stdout buffer could be lost at
exit, so the --help output was truncated, and mysql-test-run.pl failed
to parse it. Flush explicitly.

Assisted-by: Claude:claude-sonnet-5-5
ccf584d93035...
ccf584d9303577f3ac45125a3a369edb34987975
bsrikanth-mariadb
MDEV-41749: FederatedX pushdown sends "<nop>(" in pushed-down SQL

A pushed-down statement containing "x < SOME (subquery)" failed on the
remote server with a syntax error, as the query text contained the
internal "<nop>(...)" wrapper. "x < ALL (subquery)" is wrapped in
"<not>(...)" in the same way.

Item_func_not_all::print() prints the wrapper whenever `show` is set, and
Item_allany_subselect::select_transformer() sets it for every ALL/ANY
subquery. Fix it by omitting the wrapper when QT_PARSABLE is requested.
args[0] then prints the original "x op ALL|ANY (subquery)", since
Item_allany_subselect::print() re-inverts the comparator. EXPLAIN
EXTENDED and view definitions are unaffected, as they do not use
QT_PARSABLE.

The comparison is printed in parentheses because the wrapper's
precedence() is DEFAULT_PRECEDENCE, so a parent expression adds none.
Without them "0 = (a < ANY (...))" would reach the remote server as
"0 = a < any (...)" and silently return wrong rows.

Add tests to federatedx_pushdown_upd_del covering SOME and ALL in
UPDATE, DELETE and SELECT, an empty and a NULL-containing subquery, NOT,
and the predicate as an operand of another operator.
c9d08fce2672...
c9d08fce2672778ff01e82a040d035cd8d8cca54
Sergei Golubchik
MDEV-41801 "performance_schema" is compared case-sensitively in the engine, case-insensitively elsewhere

With lower_case_table_names=0 the performance_schema engine discovered
its tables only under the exact name, while ACL checks, is_perfschema_db()
and mariadb-dump matched the name case-insensitively. A database named,
for example, PERFORMANCE_SCHEMA was an ordinary database that got
performance_schema access rules.

Compare the name case-insensitively in the engine too.

Assisted-by: Claude:claude-opus-5-5
bfa708ea570f...
bfa708ea570fd6fc3194a612222b2b1c7118f98b
Miroslav Rajcic
Bug#39905057: MySQL ExtractValue unclosed CDATA length underflow causes mysqld heap overflow / crash

Problem:
========
The XML scanner reports an unterminated <![CDATA[ section as a valid
CDATA token. Its end pointer remains at the opening delimiter, while
the parser unconditionally removes the opening and closing delimiters.

This underflows the value length. ExtractValue() can subsequently pass
that length to String::append(), causing a heap overwrite and mysqld
crash.

Root Cause:
===========
my_xml_scan() only sets the token end when it finds ]]>, but
my_xml_parse() assumes every CDATA token is complete.

Solution:
=========
Detect EOF before the CDATA terminator and return a parse error before
calling the XML value handler.

Add an ExtractValue() regression test verifying that unterminated CDATA
is rejected with a warning.

Change-Id: I142bafd9ddea185f6b2e87a80af4894f10168291

Fixes MDEV-39571, MDEV-41407
bb571bae8271...
bb571bae827160e608bef793f8e07220e8fc1267
Kristian Nielsen
MDEV-40760: Stop using common_header_len and post_header_len from FD event

The FORMAT_DESCRIPTION_EVENT contains values common_header_len and
post_header_len array for individual event types, which were intended to
describe the format of following events in the binlog/relaylog. However,
this flexibility has been problematic and never useful:

- The values have never changed in MariaDB since before 10.0, nor in MySQL.

- Having to always have the correct format description event available in
  the code when reading an event causes a lot of complexity (and has
  historically caused numerous bugs).

- The potential for a corrupt or malicious format description event
  requires careful validation that these length values are correct, which
  again has historically seen bugs.

Since the values never change anyway, this patch removed the code that reads
them when reading the format description event, just using the hard-coded
values that are the only valid numbers anyway.

Remove support for ancient row events with post_header_len=6.
Remove support for reading binlogs created by custom MySQL forks with
different common_header_len (ie. MDEV-4645).

Signed-off-by: Kristian Nielsen <[email protected]>
bb4884dd32ac...
bb4884dd32ac08ebca2084ad46a66bbad97cda39
Kristian Nielsen
Validate buffer length in Log_event constructors

This patch goes through all the constructors of Log_event subclasses that
are used to implement read_log_event() and adds error checks on the size of
the event buffer to guard against out-of-buffer reads.

Adds a lot of checks, and fixes some existing checks that were wrong or in
somewhat violation of C++ standard (eg. computing a pointer outside of the
available buffer).

This removes support for reading Table_map_log_event without metadata; such
events were only written by MySQL 5.1 servers going back to 2007.

Fix some missing bits in MAX_LOG_EVENT_HEADER, and update test case
rpl.rpl_packet with a longer query to still exceed max_allowed_packet.

Signed-off-by: Kristian Nielsen <[email protected]>
bb31b9cd7e7b...
bb31b9cd7e7b89a08def8f9d188713ab8beb39b0
Vladislav Vaintroub
MDEV-41800 Flush stdout after mysqld --help

Under load on Windows, the last partial stdout buffer could be lost at
exit, so the --help output was truncated, and mysql-test-run.pl failed
to parse it. Flush explicitly.

Assisted-by: Claude:claude-sonnet-5-5
b66160b34473...
b66160b3447345c9f1780b40cbfdaf782c431791
Marko Mäkelä
MDEV-41318 after-merge fixes
ad04f47553ef...
ad04f47553ef12193b684c3fc929e1fb6a9df910
Oleksandr Byelkin
MDEV-41502 Bulk INSERT: IN list and REGEXP with a parameter use the first parameter set for all rows

Optimized array binding INSERT/REPLACE fixes the items once, and
parameters are constants, so items cache values computed with the first
set of parameters (IN array, compiled REGEXP pattern).

Do not treat parameters as constants during optimized array binding
execution.
Execute LIKE and JSON_SEARCH with a parameter in ESCAPE for every set
of parameters, as ESCAPE must be a constant.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
a7f0be7f777e...
a7f0be7f777e2fb44d79deb5ebe059a5d41e6e13
Oleksandr Byelkin
MDEV-23864 Wrong bulk affected rows with triggers and stored functions

In bulk operation reset_diagnostics_area() set DA_OK_BULK before the
first OK, so the affected rows of the previous statement were added,
and OK of trigger and stored function statements were added too.

Remember DA_OK_BULK/DA_EOF_BULK set by the bulk operation and restore
it when the diagnostics area is reset (also after an error handled in
a trigger or stored function, or a reprepare), and do not set OK status
in sub-statements of bulk operation (my_ok(), GET DIAGNOSTICS).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
a78c73a9316b...
a78c73a9316b3cd30d6c42ad7afaeaee8b97cd22
Sergei Golubchik
fix RPAD(), LPAD() and INSERT() not to mangle its arguments

they used to overwrite the charset of their arguments, this is
incorrect and led to wrong results
93bb082e7a97...
93bb082e7a97b804b7c8f581700f0f7590e46c88
Sergei Golubchik
cleanup: undefined function declarations
8fa8d9aa3aad...
8fa8d9aa3aad475cd3a1e732cfaf2b1938291f52
Sergei Golubchik
MDEV-41808 repeated CTE references keep reparsing exponentially on time and memory

Every reference to a CTE after the first re-parses its specification and
recursively resolves the references inside the clone, so a chain of CTEs
each referencing the previous one twice expands to 2^N re-parses from
linear-size SQL, exhausting CPU and memory at parse time.

Bound the number of specification clones per statement.

Assisted-by: Claude:claude-opus-4-8
8f0962026ab0...
8f0962026ab074c5ab528eb515c845ea7a58617e
Nikita Malyavin
MDEV-41238 mysqltest: add PS_bind_long command

mysqltest gets a PS_bind_long command. It binds like PS_bind, but
sends every value with mysql_stmt_send_long_data() before each
PS_execute, so a test can reach a parameter in LONG_DATA_VALUE state.
8d176901ee1b...
8d176901ee1b25e974211d5c0f15e948c40a22ab
Kristian Nielsen
MDEV-40760: Remove Format_description_log_event::event_type_permutation

The only use of this member was removed back in 2013 (!), but some (now
dead) code remains that accesses the member. This patch removes the member
and the related dead code properly.

Signed-off-by: Kristian Nielsen <[email protected]>
854869d69fdc...
854869d69fdcaeeaa353f77bcc0848f406d0aca1
Georgi Kodinov
Fix a UBSAN runtime error on MacOSX.

When running on MacOSX with `-DWITH_UBSAN` I get the following error at runtime:

```
2026-10-23 13:28:31 0 [Note] InnoDB: Number of transaction pools: 1
2026-10-23 13:28:31 0 [Note] InnoDB: Using generic crc32 instructions
2026-10-23 13:28:31 0 [Note] InnoDB: innodb_buffer_pool_size_max=8388608m, innodb_buffer_pool_size=128m
2026-10-23 13:28:31 0 [Note] InnoDB: Completed initialization of buffer pool
2026-10-23 13:28:31 0 [Note] InnoDB: End of log at LSN=51660
2026-10-23 13:28:31 0 [Note] InnoDB: 128 rollback segments are active.
2026-10-23 13:28:31 0 [Note] InnoDB: Removed temporary tablespace data file: "./ibtmp1"
2026-10-23 13:28:31 0 [Note] InnoDB: Setting file './ibtmp1' size to 12.000MiB. Physically writing the file full; Please wait ...
2026-10-23 13:28:31 0 [Note] InnoDB: File './ibtmp1' size is now 12.000MiB.
2026-10-23 13:28:31 0 [Note] InnoDB: log sequence number 51660; transaction id 14
2026-10-23 13:28:31 0 [Note] InnoDB: Loading buffer pool(s) from /Users/gkodinov/dev/mdev-35715/bld/x/ib_buffer_pool
2026-10-23 13:28:31 0 [Note] Plugin 'FEEDBACK' is disabled.
/Users/gkodinov/dev/mdev-35715/mysys/my_stack.c:74:38: runtime error: addition of unsigned offset to 0x00016bcc0050 overflowed to 0x00016b1c2050
```

This is caused by STACK_DIRECTION being negative and, when multiplied by an unsigned, being converted to a large unsigned before the multiplication.

Change stack_size type from size_t to ssize_t to avoid this.
845ad721d092...
845ad721d09241bf26d0db8751a51cf352f0b55f
Kristian Nielsen
Merge branch 'knielsen_log_event_read_validation_base_10.11' into 10.11
82e4333404e7...
82e4333404e766f6c26a5a77f9aefc402a99fa2c
Oleksandr Byelkin
MDEV-23864 BULK insert wrong values when command contain inner select

Optimized array binding INSERT/REPLACE executes the statement once,
so subqueries are executed with the first set of parameters only.

Execute INSERT/REPLACE, where a subquery result depends on parameters,
for every set of parameters (as not optimized array binding commands
are executed), keeping the first generated id as the result of the
whole operation.
Per-row execution also needs warnings counted once, RETURNING metadata
sent once (also after reprepare), and an error allowed after
successful rows.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
824a4ad46af0...
824a4ad46af098486e7fe92af0ce7cb895f90e1d
Sergei Golubchik
UndefinedBehaviorSanitizer: nullptr-with-nonzero-offset rdb_datadic.cc:558
7d7be50ab451...
7d7be50ab451461c30a5f9533a0cd5e6179ca9c4
Sergei Petrunia
Rename sp_head::dont_freeze_mem_root to dont_freeze_mem_root2,

and do NOT set it in set_dont_freeze_mem_root()
723ea87e2e7a...
723ea87e2e7aba7eedfe7c6ede2eb0f4bc163c29
Kristian Nielsen
MDEV-40760: Remove unused Format_description_log_event * arguments

Follow-up patch, remove a lot of Format_description_log_event * function
arguments that are no longer needed.

Signed-off-by: Kristian Nielsen <[email protected]>
6a063120d4d3...
6a063120d4d3d451bff3ea84b3ffbee288b33be8
Oleksandr Byelkin
MDEV-23864 Bulk INSERT loses rows if a stored function executes DML

A DML statement of a stored function called by an optimized array
binding INSERT consumed the next sets of parameters of the bulk
operation.

Reset THD::bulk_param during the function execution, as it is done
for triggers.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
61fcf863b63c...
61fcf863b63cdbccd28e492322a76079b3feb25b
Georg Richter
Fix test: use DATETIME type instead of TIME
44116eca17c7...
44116eca17c7b4230e85a5a48840b4a9c279a8fd
Rex Johnston
MDEV-36295 INTERVAL function returns inconsistent results when used in a WHERE clause

A query like

  select * from (select a, b from t1 group by a, b) d
    where interval(d.a, 3, 7) = 1

returned no rows when the condition was pushed into the derived table,
although the row (5,20) matches, as condition_pushdown_for_derived=off
shows.

Item_func_interval kept its first argument, the Item_row, in a member
of its own as well as in args[0]. Condition pushdown copies the condition
with deep_copy(). The copy of the node got new arguments but kept the
member, so it went on reading the original row: the INTERVAL() pushed into
the derived table compared the original outer column, and the pushed
condition rejected every row.

Item_func_interval now reads the row through args[0] alone, so a copy
cannot point anywhere else.

This commit was prepared with Claude Code (Opus 5).
380d94dc4e36...
380d94dc4e36452f27e388186cb825b42798df1b
Sergei Golubchik
Item_param::set_param_time and Item_param::set_param_datetime OOB read

Item_param::set_param_time and Item_param::set_param_datetime could
potentially read 4 bytes beyond the value end of the corrupted packet
2ed262bfb28c...
2ed262bfb28cbb782c7671f5c5301ab85316528e
Kristian Nielsen
Fix hang on master when disabling semi-sync

There is a global variable global_ack_signal_fd used to signal the receiver
thread to wake up when disabling semi-sync. This variable was cleared to -1
in the Ack_listener destructor, which ran at the end of the
Ack_receiver::run() function without any locking. If the thread was delayed
at that point, it could end up overwriting the new value set by a new
receiver thread. This would leave the server in a state with an invalid
global_ack_signal_fd and could cause a subsequent disable of semisync to
fail due to the wakeup not arriving at the receiver thread.

This was seen as a sporadic failure of the test case
rpl.rpl_semi_sync_cond_var_per_thd.

Fix by not modifying the global in constructor/destructor; instead set and
clear the global explicitly, allowing to clear the fd with proper locking
while the mutex is still being held.

Also fix a missing pthread_join(), which would leak thread descriptors and
allow to start a new receiver thread before the old one shut down fully.

(Either of these two changes fix the hang bug).

Signed-off-by: Kristian Nielsen <[email protected]>
29f47134526c...
29f47134526ce2622c12810b035a81dc8b6202c9
Sergei Golubchik
MDEV-41804 deeply nested ROWs crash

add check_stack_overrun()
298633e150d4...
298633e150d48bf7cf1c78bf56a3b73fda42025d
Nikita Malyavin
MDEV-41238 Bound parameters prevent condition pushdown into a grouped view, while CAST enables it

Item_param::deep_copy() returned NULL, and every rewrite that copies a
condition gives up on what it cannot copy. A conjunct holding a
prepared statement parameter was therefore left out of:
- pushdown into derived tables and views, including UNION branches
  and conditions on a derived table column whose expression holds a
  parameter;
- pushdown from HAVING to WHERE, for the part extracted from an OR;
- pushdown into a materialized IN subquery;
- split materialization, which then found no split key;
- the UPPER(col) IN (...) rewrite, which has skipped such conjuncts
  since MDEV-40006.
When the derived table groups by an expression with a parameter, the
condition was pushed into its HAVING instead of its WHERE.

CAST(? AS ...) worked around this only by accident. Before the
pushdown, constant propagation can replace a constant expression on
one side of = with a literal. A bare parameter already counts as a
basic constant, so propagation leaves it as it is. A client whose
charset differs from the column's got the pushdown by a similar
accident: the charset conversion replaces the parameter with a
literal.

Item_param::shallow_copy() now copies a parameter that holds a value,
NULL included, and deep_copy() calls it, as in other leaf items. Every
such copy is made while optimizing during EXECUTE, and the next
EXECUTE makes a new one, so a copy always carries the value bound for
the EXECUTE that made it. A copy that outlived its EXECUTE would keep
an old value and point into a string buffer that the next binding may
free, so shallow_copy() asserts that it does not allocate on the
statement's arena.

The copy is not added to m_clones. m_clones keeps the parameter's
copies in CTE definitions updated with each new value for the whole
life of the statement, while this copy lives for one execution.

An unbound parameter, DEFAULT and IGNORE still have no copy.
2816e9e91d25...
2816e9e91d25fda0d0e74ce833a314e34a08eb30
Sergei Golubchik
MDEV-41622 INSERT crashes on deeply nested GeometryCollection

- get_data_size() and init_from_wkb() return their error values on
  stack overrun, not a valid-looking length
- add stack checks to the remaining recursive GeometryCollection
  methods: wkt, json, mbr, area, length, dimension, store_shapes
- test non-GEOMETRY column and SELECT paths

Assisted-by: Claude:claude-opus-5-5
245cd86c17a3...
245cd86c17a3fd8a4a463ad222d747d36fe53d8a
Vladislav Vaintroub
MDEV-41800 Flush stdout after mysqld --help

Under load on Windows, the last partial stdout buffer could be lost at
exit, so the --help output was truncated, and mysql-test-run.pl failed
to parse it. Flush explicitly.

Assisted-by: Claude:claude-sonnet-5-5
236058ae39e8...
236058ae39e86168a80f604eb19db0a7dca71375
Sergei Golubchik
MDEV-41822 mariadb-binlog ASAN crash on corrupted binlog

1. verify that the null bitmap length doesn't overshoot row event end
2. pass the buffer length to calc_field_size(), so that it'd never read
  beyond the end
1e3df6ec8aa6...
1e3df6ec8aa66daa2a65771aaf36ca18db7f649a
Kristian Nielsen
Merge into main 10.11
14df3d04737c...
14df3d04737cb4404d47a39bfc8dbbed308aeea9
Raghunandan Bhat
MDEV-40836: SIGSEGV in my_time_fraction_remainder

Problem:
  A window function inside an ORDER BY expression was split twice by
  `split_sum_func()` first in `setup_order()`, then again in
  `JOIN::prepare()`. Each split adds the item to `ref_pointer_array`,
  which resulted in overflow.

  The split in `setup_order()` was added by MDEV-28094 (8c34eab) to fix
  a crash in -
    SELECT EXISTS (SELECT 1 ORDER BY 1+sum(2) OVER ());

  `check_and_do_in_subquery_rewrites()` dropped the ORDER BY of that
  subquery, so `JOIN::prepare()` never split it. But its window function
  remained in `window_funcs` and was still processed, causing the crash.

Fix:
  - When sub-query re-write drops the ORDER BY, also drop its window
    functions (already done for UNIONs).
  - Remove the window function split from `setup_order()`, so it is
    done only once, in `JOIN::prepare()`.
00e25e51a5d8...
00e25e51a5d8544d7d68ff6a04995a2b0d52f608
Kristian Nielsen
MDEV-40745: Validate field parsing of optional_metadata

Protect accesses into the m_optional_metadata buffer to not access outside
of the buffer in case of corrupt/malicious event data.

Protect against buffer overflow of the m_column_name array in case of
excessive column names in the event data.

Signed-off-by: Kristian Nielsen <[email protected]>
BuildBot (0.8.9) working for the MariaDB project.
Page built: Mon 26 Oct 2026 12:27:43 (UTC)