Home - Waterfall Grid T-Grid Console Builders Recent Builds Buildslaves Changesources - JSON API - About

Console View


Categories: connectors experimental galera main
Legend:   Passed Failed Warnings Failed Again Running Exception Offline No data

connectors experimental galera main
Sergei Golubchik
MDEV-41626 definer check in CREATE PROCEDURE is too lax
Sergei Golubchik
MDEV-41613 CONNECT jfile_convert crashes on invalid file

Assisted-by: Claude:claude-opus-5-5
Sergei Golubchik
MDEV-41603 DECODE_HISTOGRAM crashes when decoding JSON_HB

don't return a pointer to a local buffer
Sergei Golubchik
cleanup: undefined function declarations
Sergei Golubchik
cleanup: CONNECT tests
Sergei Golubchik
MDEV-41467 mbstream insufficient path validation in REMOVE and RENAME chunks

apply the check from file_entry_new() also to other file operations

also: swap names in the the rename error message
Sergei Golubchik
fix RPAD(), LPAD() and INSERT() not to mangle its arguments

they used to overwrite the charset of their arguments, this is
incorrect and led to wrong results
Sergei Golubchik
MDEV-41608 some CONNECT jfile/bfile udfs ignore FILE and secure_file_priv

also they should all have maybe_null=true
Sutou Kouhei
Fix auto directory creation for absolute mroonga_database_path_prefix (#1166)

mkdir_p() tried stat("") and mkdir("") for the leading directory
separator of an absolute path and gave up. So we couldn't create
database directory automatically for absolute
mroonga_database_path_prefix such as "/var/lib/mroonga/".

This also treats EEXIST from mkdir() as success because another process
may create the directory after our stat().

Assisted-by: Claude:claude-5.5-opus
Sergei Golubchik
cleanup: CONNECT rest.test

no need to run the same CREATE TABLE twice, first to check if it works
and then to test its result
Sergei Golubchik
CONNECT: jfile_bjson/jfile_convert/bfile_bjson/bfile_convert crash on lrecl=NULL

tests for
* constant NULL
* not constant NULL
* not constant not NULL

Assisted-by: Claude:claude-opus-5-5
Sergei Golubchik
CONNECT: udfs crash on long filename

namely, json_get_item, jsonget_string, json_set_item, jbin_set_item,
bson_get_item, bsonget_string, bson_set_item

Assisted-by: Claude:claude-opus-5-5
Sergei Golubchik
MDEV-41496 OOB write with RPAD() crash and multi-byte charsets and uservar

Item's charset is metadata, it's known at fix_fields and does not
change later. User variables can violate this invariant if they're
changed and used in the same query.

Let's always wrap such variables in Item_func_conv_charset()
to make sure the caller always gets the same fixed charset, no matter
what the actual variable value is.

Variables that aren't changed in the same query do not get this
unnecessary conversion.

Note that in --ps the charset might resolve differently. This is not a
bug, querying and modifying a user variable in the same query is a
documented UB. But both in nm and in ps both arguments of RPAD() always
have the same charset, so the result is internally consistent and
there's no OOB access.
Sergei Golubchik
MDEV-41641 CONNECT REST can bypass FILE protection

only allow http and https schemes for REST
Sergei Golubchik
MDEV-41431 LOAD_FILE checks for is_secure_file_path() one path but opens another
Sutou Kouhei
MDEV-41287 ASAN: stack-buffer-overflow in strcpy/mrn::DatabaseRepairer::detect_paths/mrn::DatabaseRepairer::each_database

Fix a buffer overflow with long mroonga_database_path_prefix (#1159)

Reported by Yuelin Wang. Thanks!!!

We used fixed size buffers (MRN_MAX_PATH_SIZE) for database paths built
from mroonga_database_path_prefix. So a long
mroonga_database_path_prefix caused a buffer overflow.

This uses std::string for them. We don't need to check path length in
Mroonga because Groonga reports an error for too long path.

Assisted-by: Claude:claude-5.5-opus
Oleksandr Byelkin
MDEV-40727 fix galera.MDEV-40727 on symlinked vardir and non-Linux

The SST script logs physical paths, so the search failed when the
vardir is a symlink (e.g. to /dev/shm). Match only the part below the
vardir, run the test on Linux only (elsewhere nothing is logged), and
suppress node_2's warning on the replicated DROP of the shared file.
Oleksandr Byelkin
MDEV-39306 fix race in versioning.rpl_row

The slave created table t before the master's previous DROP TABLE t
was replicated. Sync the slave after the drops.
Sergei Golubchik
MDEV-41540 filesort assert crash on a huge sort key

sort key could go over 4GB making sort length to wrap around.
let's limit sort key length by 2GB - still ridiculously unrealistically
large but far enough from 4GB so that any additions in the code below
would still be safe.

The error is somewhat confusing, but, again, only someone who pushes
the margins to exploit memory bugs will ever see it.

Additionally min_sort_memory calculations are done as uint and
can wrap around too, allocating later over 4GB memory not constrained
by @@sort_buffer_size
Sergei Golubchik
cleanup: remove unused variable
Sergei Golubchik
Xcurl

* drop the redundant linux-only check "does curl exist?", let it
  fail as on Windows, when curl is executed (also that branch
  was missing one pclose())
* use _exit() not exit() - see `man vfork`
* on linux: wait for the correct (!) child to exit, don't ignore
  its failures (Windows code didn't)
* rephrase awkward message
Sergei Golubchik
cleanup: CONNECT use a local HTTP server in connect.rest

The test depended on an external site, so it was slow and unreliable.
Serve std_data/bios.json from a forked perl server instead.

Assisted-by: Claude:claude-opus-5-5
Sergei Golubchik
CONNECT: reset vptr before writing an object to a file

pointers make no sense there
Sergei Golubchik
MDEV-41622 INSERT crashes on deeply nested GeometryCollection

- get_data_size() and init_from_wkb() return their error values on
  stack overrun, not a valid-looking length
- add stack checks to the remaining recursive GeometryCollection
  methods: wkt, json, mbr, area, length, dimension, store_shapes
- test non-GEOMETRY column and SELECT paths

Assisted-by: Claude:claude-opus-5-5
Sergei Golubchik
ER_OUT_OF_SORTMEMORY should not be ME_ERROR_LOG+ME_FATAL

it's not OOM, it's "filesort requires more memory than a user specified
session local limit". Not a hardware limitation, but something
an unprivileged user configured in her own session (so, shouldn't
be ME_ERROR_LOG). And unlike true low-memory situation this error
condition doesn't affect following statements (so, shouldn't be ME_FATAL)
Sergei Golubchik
CONNECT: fix NULL handling for jfile_bjson/jfile_convert/bfile_bjson/bfile_convert

to be consistent with other functions

Assisted-by: Claude:claude-opus-5-5
Oleksandr Byelkin
MDEV-40386 DuckDB configure fails in rpm builds

DuckDB's configure checks link with -specs=redhat-package-notes but
without the RPM_* environment, and the linker launcher list was split
into separate cmake arguments. Run DuckDB's cmake under the launcher's
env and pass the launcher with a non-";" list separator.
Sergei Golubchik
Item_func_decode_histogram::val_str shouldn't modify its arguments
Miroslav Rajcic
Bug#39905057: MySQL ExtractValue unclosed CDATA length underflow causes mysqld heap overflow / crash

Problem:
========
The XML scanner reports an unterminated <![CDATA[ section as a valid
CDATA token. Its end pointer remains at the opening delimiter, while
the parser unconditionally removes the opening and closing delimiters.

This underflows the value length. ExtractValue() can subsequently pass
that length to String::append(), causing a heap overwrite and mysqld
crash.

Root Cause:
===========
my_xml_scan() only sets the token end when it finds ]]>, but
my_xml_parse() assumes every CDATA token is complete.

Solution:
=========
Detect EOF before the CDATA terminator and return a parse error before
calling the XML value handler.

Add an ExtractValue() regression test verifying that unterminated CDATA
is rejected with a warning.

Change-Id: I142bafd9ddea185f6b2e87a80af4894f10168291

Fixes MDEV-39571, MDEV-41407
Sergei Golubchik
MDEV-39625 plugin/auth_pam/testing/CMakeLists.txt breaks INSTALL_MYSQLTESTDIR= suppression
Sergei Golubchik
MDEV-39624 storage/connect/CMakeLists.txt: unguarded generator expression variable causes fatal error at cmake generate phase
Sergei Golubchik
UndefinedBehaviorSanitizer: nullptr-with-nonzero-offset rdb_datadic.cc:558
Sergei Golubchik
MDEV-41648 sequence permissions aren't checked in LOAD DATA
Sutou Kouhei
MDEV-41285 ASAN heap-buffer-overflow mrn_get_string_between_quote/mrn_parse_table_param

Fix a heap buffer overflow on escaped string in table/index comment parameter (#1249)

`mrn_get_string_between_quote()` didn't advance `current_ptr` after it
processed an escape sequence such as `\x`. So it wrote the escaped
character repeatedly and overflowed the allocated buffer. It also didn't
terminate the extracted string with `\0` when the string had an escape
sequence.

For example, the following SQL caused a heap buffer overflow:

```sql
CREATE TABLE t1 (c INT) ENGINE=Mroonga COMMENT='engine "InnoDB\\x"';
```

This also returns `NULL` when `mrn_my_malloc()` fails.

Reported by Alice Sherepa. Found by Yuelin Wang.

Assisted-by: Claude:claude-5.5-opus
Sergei Golubchik
cleanup: use StringBuffer<>
Sergei Golubchik
MDEV-41287 additionally validate sysvar value to be < 4096
Sergei Golubchik
CONNECT: more FILE and secure_file_priv checks in udfs

Assisted-by: Claude:claude-opus-5-5
Sergei Golubchik
MDEV-41458 Assertion `n > 0 && n < SINUSES_CALCULATED*2+1' failed in get_n_sincos()

With tiny *ex and *ey the sum of squares underflows and q becomes inf,
use hypot() which is under- and overflow safe.

Also, fix ab/(d*d) divison, for good measure
Sergei Golubchik
fixup! CONNECT: json_bson_file_priv test fails in MSAN
Sergei Golubchik
CONNECT: json_bson_file_priv test fails in MSAN

1.
the fix for MDEV-41613 added the first ever test for jfile_bjson().
this UDF allocates structures on the heap and dumps them to a file
with fwrite(). Structures may have padding, bytes in padding stay
not initialized and MSAN gets unhappy when they're fwritten.

Let's clear the allocated memory area for file-writing UDFs

2.
jbin_set_item sends BSON structure as blob in the result set.
So this structure must not have uninitialized bytes either.