Home - Waterfall Grid T-Grid Console Builders Recent Builds Buildslaves Changesources - JSON API - About

Console View


Categories: connectors experimental galera main
Legend:   Passed Failed Warnings Failed Again Running Exception Offline No data

connectors experimental galera main
f9777dddf8d1...
f9777dddf8d12e8f0d8ae22f79ac2c5d588411c3
Oleksandr Byelkin
Merge branch 'bb-11.4-release' into bb-12.3-release
f01197177a3b...
f01197177a3b7c86bf66cb43be279024d1b92108
Oleksandr Byelkin
Merge branch '10.6' into bb-10.11-release
e21fb771e9dc...
e21fb771e9dc942e862c0072673024a529fde82a
sjaakola
MDEV-36677 rsync sst fails with different innodb_log_group_home_dir and datadir

Backported the fix done by Pekka Lampio for mariaDB 11.4 in PR
https://github.com/mariadb-corporation/codership-mariadb-server/pull/543

The PR has a fix for wsrep_sst_rsync script and new mtr test:
galera_3nodes.galera_mdev_36677" to check that the rsync SST method of Galera
works correctly also when the joiner node store InnoDB log files in a dedicated
directory separate from the data dictionary

Note: merging this PR to 11.4 may not be fully functional as there are other
changes in the rsync SST script. Take a look at the original 11.4 PR when merging.
d427a3138bdb...
d427a3138bdbc36ed6d9d30833a17eb778154b56
Alexander Barkov
MDEV-40009 SIGSEGV in Sql_path::from_text

Problem:
- The string passed to Sql_path::from_text() could be in
  various character sets, returned by Item::val_str_ascii(),
  which is not necessarily utf8mb3.
- While the code in Sql_path::from_text() was written in the way
  that "str" was considered to be in utf8mb3.
- As as result, cs->charset() in this line:
    auto len = cs->charlen(curr, end);
  could return a negative value and the whole loop got stuck.

Changes:
- Fixing Sys_var_path::from_item() to use val_str() instead of val_str_ascii(),
  to get the original value from "item", without any conversion.
- Moving the conversion code inside Sql_path::from_text().
d35ec4c8f049...
d35ec4c8f0498815b4b86063008d7adbfe02eb72
Oleksandr Byelkin
Merge branch '10.11' into bb-10.11-release
c7b5ed8f21a6...
c7b5ed8f21a62b6e95842aeda900bbc06a062932
Oleksandr Byelkin
Merge branch 'bb-12.3-release' into bb-13.0-release
c38073eb6c63...
c38073eb6c63295a36df16bdf276d97bc8e4bc81
Daniel Black
MDEV-40572 SIGSEGV in JSON_OVERLAPS()

on a truncated nested JSON object with different character sets/collations.

The value->s.c_str and js->s.c_str became invalid once the
function returned which caused the crash.
b608e108d850...
b608e108d850c3955b4fdde306d2e7f7b128c66d
forkfun
MDEV-40584 ST_CROSSES always returns 0 for different-dimension geometries

MDEV-36058 added a dimension-equality check ("Both geometries must
have the same number of dimensions") for SP_OVERLAPS_FUNC, but a
stray fall-through from SP_CROSSES_FUNC into that same case made
CROSSES share it too. CROSSES is defined precisely for geometries
of different dimensions, so any such pair now hit
"if (g1_dim != g2_dim) DBUG_RETURN(0)" and always returned 0.

Give SP_CROSSES_FUNC its own case again, calling
handle_sp_crosses_func_case() directly without the dimension check.
SP_OVERLAPS_FUNC keeps the check.
7d73a695267b...
7d73a695267b09c9025b629ee7b12ee5f5d49b2e
Jan Lindström
MDEV-40645 : Slave Crash on Malformed User_var_log_event

A crafted DECIMAL user variable event makes bin2decimal() allocate and
copy a size taken entirely from two attacker-supplied bytes.

bin2decimal() has no parameter telling it how many bytes are available
(strings/decimal.c:1424):

  int bin_size= decimal_bin_size(precision, scale);
  sanity(to);
  d_copy= (uchar*) my_alloca(bin_size);
  memcpy(d_copy, from, bin_size);

decimal_bin_size() guards its inputs with DBUG_ASSERT(precision > 0)
and DBUG_ASSERT(scale <= precision) only, so release builds proceed with
anything. my_alloca is real alloca in this build.

Precision and scale arrive as val[0] and val[1]. Three call sites
pass them through:

* the applier, User_var_log_event::do_apply_event
(sql/log_event_server.cc:4563), which checks only val_len < 3
* pack_info (sql/log_event_server.cc:4356), which checks nothing, not
even val_len >= 3
* mysqlbinlog (sql/log_event_client.cc:2489), which checks nothing
The constructor does bound val_len against the event
(sql/log_event.cc:3064), so val_len is honest, but nothing ties
decimal_bin_size(val[0], val[1]) to it. val_len of 3 with a precision
of 65 already asks for 30 bytes where 1 is available.

Fixed by adding guards against malformed precision, scale and
val_len.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
64fa85d6c20d...
64fa85d6c20d0bfb4156fc937cc0777416372089
Oleksandr Byelkin
Merge branch 'bb-10.11-release' into bb-11.4-release
5b9200a2896e...
5b9200a2896e22caaa782a3bfd67677554444bcb
Oleksandr Byelkin
fix merge
5b838c29d7a4...
5b838c29d7a4c4e044183aeae0bd9b176fb898bd
Oleksandr Byelkin
Merge branch '10.11' into bb-10.11-release
3388a32da87b...
3388a32da87b9dffc63be153880a6b87c08b2a9a
Oleksandr Byelkin
Merge fix.
30cfec8746e6...
30cfec8746e6d8b211b3f6f5c1fe1178e6597d58
Alexander Barkov
MDEV-40009 SIGSEGV in Sql_path::from_text

Problem:
- The string passed to Sql_path::from_text() could be in
  various character sets, returned by Item::val_str_ascii(),
  which is not necessarily utf8mb3.
- While the code in Sql_path::from_text() was written in the way
  that "str" was considered to be in utf8mb3.
- As as result, cs->charset() in this line:
    auto len = cs->charlen(curr, end);
  could return a negative value and the whole loop got stuck.

Changes:
- Fixing Sys_var_path::from_item() to use val_str() instead of val_str_ascii(),
  to get the original value from "item", without any conversion.
- Moving the conversion code inside Sql_path::from_text().
210ab6edf47f...
210ab6edf47fa73f3b77e974ed2e9357ccdd051c
Alexander Barkov
MDEV-40722 DROP PACKAGE leaves PACKAGE BODY grant in mysql.procs_priv

DROP PACKAGE now removes both PACKAGE BODY and PACKAGE privileges
for the given package.
0f6fc6a032b3...
0f6fc6a032b3cbcea2a25196141f6661215396c2
Oleksandr Byelkin
Merge branch 'bb-10.11-release' into bb-11.4-release
0cb7c2f61d7c...
0cb7c2f61d7cbfd535630938316cc30210518138
Daniel Black
MDEV-40165 JSON_EQUAL/JSON_NORMALIZE/JSON_CONTAINS error handling

Adds test cases that validate the incorrect null handling
in the 2894e90b6545d3c7fa13ff00fb50c9e8631003e7 commit
and other JSON_EQUALS,CONTAINS/OVERLAPS behaviour.
BuildBot (0.8.9) working for the MariaDB project.
Page built: Wed 12 Aug 2026 08:51:42 (UTC)