Home - Waterfall Grid T-Grid Console Builders Recent Builds Buildslaves Changesources - JSON API - About

Console View


Categories: connectors experimental galera main
Legend:   Passed Failed Warnings Failed Again Running Exception Offline No data

connectors experimental galera main
Daniel Black
MDEV-39813 ST_GeomFromGeoJSON does not control recursion depth

Geometry::create_from_json reset the killedptr and the stack
depth (stack_p) every time json_scan_start was called. We save/
restore these values so that the ST_GeomFrom_GeoJSON can be killed
and incur timeout, and also so that its depth measurement is kept.

Test case an bug report thanks to byteoverride.
Hemant Dangi
MDEV-28239: rsync and mariabackup SST scripts handle sst ssl_mode option differently

Issue:
The mariabackup SST script enabled a peer certificate name check
for any ssl-mode starting with VERIFY, so VERIFY_CA behaved like
VERIFY_IDENTITY, unlike the rsync script.

Solution:
For VERIFY_CA verify the chain only - drop the socat
"commonname" check in mariabackup and gate the rsync checkHost/checkIP
on VERIFY_IDENTITY.
Daniel Black
MDEV-39276: Assertion `0` failed in json_find_path

This was resolved with MDEV-35548, however we add
two additional test cases.
Daniel Black
MDEV-39691 wsrep.cnf contains deprecated wsrep_causal_reads

wsrep_causal_reads was deprecated in 10.1.3 and removed in 11.3.1.
Put in place the equivalent (and default) wsrep_sync_wait=0.

Amend a few early comments to show MariaDB as our product.
Hemant Dangi
MDEV-23744: Unable to specify both client and server certificates.

Issue: The SST TLS options are not role-specific, so a node cannot
present a different certificate as donor (TLS client) than as joiner
(TLS server), which some environments require.

Solution: In the shared check_server_ssl_config, add role-specific
options that override the generic ones: ssl-server-{ca,capath,cert,key}
for the joiner and ssl-client-{ca,capath,cert,key} for the donor.
Applies to both mariabackup and rsync SST.
Alexey Botchkov
MDEV-31267 Server crash or assertion failure in get_n_sincos with nested ST_BUFFER.

The double precision is not enough when intersecting lines become too
parallel.
We can safely use border values for it.
Alexey Botchkov
Update submodule link
Alexey Botchkov
MDEV-39750 ExtractValue does not control recursion depth.

    More stack needed here.
Dmitry Shulga
MDEV-36481: Abnormal server termination on second execution of stored routine that runs a cursor after table metadata in the query was changed

On parsing the statement 'DECLARE var1,...,varN TYPE OF cur DEFAULT value'
an instance of the class Item_splocal that created on handling the clause
'DEFAULT value' is shared between two classes sp_instr_cursor_copy_struct and
sp_instr_set. In result, in case metadata changed and cursor has to be re-parsed,
items associated with the SP instruction sp_instr_cursor_copy_struct
are deallocated and one of deallocated items is the one representing the value
the `DEFAULT value` clause. On the other hand, the data member
sp_instr_set::m_value still references the deallocated item. It leads to server
abnormal termination on second run of a stored routine containing the statement
'DECLARE ... TYPE OF ... DEFAULT value'

To fix the issue pass owning of an instance of the class Item_splocal to
the class sp_instr_cursor_copy_struct and deallocated it explicitly on
closing the stored routine.
Alexey Botchkov
MDEV-39750 ExtractValue does not control recursion depth.

    More stack needed here.
jmestwa-coder
MDEV-40200 bound shift width in dyncol integer readers

The dynamic column integer decoders derive the shift exponent from the
data interval length without bounding it to the 64-bit type width.

dynamic_column_uint_read() loops over the interval doing
value+= data[i] << (i*8). A record whose integer column has an interval
longer than 8 bytes drives i*8 to 64 and past it, which is undefined and
aborts under -fsanitize=shift. dynamic_column_var_uint_get(), used for the
charset id of a string value and for the intg/frac of a decimal, has the
same defect: length*7 grows without bound over a run of 0x80 continuation
bytes.

Reject integers longer than 8 bytes with ER_DYNCOL_FORMAT, propagate that
through dynamic_column_sint_read(), and cap the varint loop at 10 groups.

To reproduce, build with -fsanitize=shift and read with COLUMN_GET() a
record whose integer column data interval exceeds 8 bytes; the shift
exponent reaches 64 in dynamic_column_uint_read(). A new case in the
ma_dyncol unit test crafts such a record and checks it is rejected.
Alexey Botchkov
Another fix.
Vladislav Vaintroub
MDEV-14443 DENY statement

Implements DENY/REVOKE DENY and associated tasks.
Alexey Botchkov
MDEV-39750 ExtractValue does not control recursion depth.

    More stack needed here.
Raghunandan Bhat
MDEV-39450: Memory corruption: overlapping memory ranges in `Field_longstr::compress` on UPDATE of compressed column

Problem:
  Values shorter than `column_compression_threshold` (default 100) are
  stored uncompressed. Reading such a column returns a pointer into that
  buffer rather than a copy.

  When the new value is a substring of the column that aliases this
  buffer at a non-zero offset, e.g. `RIGHT(c,n)` or `SUBSTRING(c,n)`,
  the source and destination overlap, and the `memcpy()` in the "store
  uncompressed" path copies overlapping regions, which is undefined
  behaviour.

Fix:
  Replace `memcpy` with `memmove` to avoid copying between overlapping
  memory regions.
Jan Lindström
MDEV-40056 : Analyze Galera Dynamic Variables Susceptible to RCEs

Fix potential issue with wsrep_node_address by allowing
only correctly constructed address.
Luke Lu
MDEV-39689: Fix OOB reads in Table_map_log_event parsing

Add bounds checks to prevent out-of-bounds memory reads when parsing
Table_map_log_event optional metadata and constructor fields.

The checks prevent OOB reads but do not attempt to throw errors for
every possible corruption. Replication fundamentally assumes a trusted
source with valid data. The goal here is hardening against accidental
corruption (truncated events, garbled metadata lengths). On detecting
corruption, the slave either falls back gracefully to positional column
mapping (parse_* functions) or rejects the event entirely (constructor),
rather than crashing or leaking heap contents via OOB reads.

parse_* functions: Add if (unlikely(p > end)) return after every
net_field_length() call. Ensures decoded values are validated before
being stored to struct fields, preventing information disclosure from
OOB reads. On early return, the slave gracefully falls back to
positional column mapping.

Table_map_log_event constructor: Add bounds checks before memcpy calls
for m_colcnt, m_field_metadata_size, and m_null_bits. On overflow, frees
allocated memory and sets m_memory=NULL causing is_valid() to return
false. Adds read-side DBUG_EXECUTE_IF injection points for testing.

Functions fixed:
- parse_default_charset
- parse_column_charset
- parse_column_name
- parse_set_str_value
- parse_geometry_type
- parse_simple_pk
- parse_pk_with_prefix
- Table_map_log_event constructor (m_colcnt, m_field_metadata, m_null_bits)

MTR test rpl_table_map_log_event_overflow covers all affected code paths
with 9 test cases using debug injection.
Oleksandr Byelkin
MDEV-40159: single quote in DATA DIRECTORY breaks SHOW CREATE TABLE

Correct append function called for value in quotes
Vladislav Vaintroub
MDEV-14443 DENY statement

Implements DENY/REVOKE DENY and associated tasks.
forkfun
new wolfssl v5.9.2-stable
Raghunandan Bhat
MDEV-40316: Infer: PULSE_RESOURCE_LEAK in connect

Problem:
  Infer found file descriptors left open on some error code paths in
  connect storage engine.

Fix:
  Close file descriptors on error before returning.
Vladislav Vaintroub
MDEV-39047 Impossible to create DB grant for long escaped DB name

The database name in GRANT is stored in mysql.db.Db, which holds 64
characters. Escaping '_' or '%' with a backslash to match them literally
can make the stored name longer than 64 characters, and it was silently
truncated into a non-functional grant. Reject it with ER_WRONG_DB_NAME
instead, the same error CREATE DATABASE gives for an over-long name.
Daniel Black
MDEV-39829/MDEV-33532 s3.debug test failure

MDEV-39516 corrected the interface with curl particularly around
passing options.

After this the s3.debug actually enabled curl debugging like is
was meant to. With this enabled, there are addition s3_test_ pattens
in the result file, from the error log where curl correctly provide
debug message.

ps-protocol test also failed under MDEV-33532 where a differnet
number of entries was recored.

Correct variations by using the $database/$table rather than just the
s3_test_ pattern.

As the purpose of this test is to check if s3_debug is dynamic, the
second part of the test searches for a previously, under s3_debug=1,
table t2 interaction, where the results should be NOT_FOUND.

Remove count from the result file to allow for different curl versions
and the possibiliy of being run under ps-protocol.
bsrikanth-mariadb
MDEV-40384: innodb_gis.geometry fails on replay

The test had innodb_strict_mode turned OFF, when running the test. But,
in the replay, it was enabled, which caused the creation of tables with
KEY_BLOCK_SIZE=16 fail.

Solution is to record the innodb_strict_mode variable in the context, so
that it gets used during the replay.
Alexey Botchkov
one more fix.
Raghunandan Bhat
MDEV-38075: Make sysV init script check for actual function presence

Problem:
  The current implementation of the sysvinit script only creates
  `log_success_msg()` and `log_failure_msg()` fallback functions when
  not finding an /etc/init.d/functions file to include.

  Newer RHEL releases do not define those functions in that file
  anymore.

Fix:
  Check if the functions are defined and provide fallback functions if
  they are not defined.
Brandon Nesterenko
MDEV-39710: Update git modules WSREP Links to mariadb-corporation

The .gitmodules file still uses the old Codership Github repo link. This
redirects to the mariadb-corporation repo, so it isn't a functional
problem, but it should still be updated to the correct repo.

Reviewed-by: Teemu Ollaka <[email protected]>
Daniel Black
MDEV-37615: Clang based static analysis false postive reports on UNINIT_VAR

Clang upstream bug https://github.com/llvm/llvm-project/issues/173210
shows that a "int x=x" construct will in the intermediate representation
have code to read from x. With this generated sanitizer=undefined and
static analyzers will all see the uninitialized read and write.

Because clang has a stronger implementation of following paths to
uninitialized variables, "#define UNINIT_VAR(x) x" is the which
is what our release binaries use is the ideal path for this compiler.

Clang based compilers with error during compilation if any
uninitialized behaviour is detected at compile time because of
0c80ddb519bd06efbd7ccf2a2487b2503cd16db5.

Corrects MDEV-36542 - 6fd57f478f585249bdca242b1576ac0a7bd7aacf.
Daniel Black
spelling correction: support-files/wsrep.cnf.sh

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
Rucha Deodhar
MDEV-32726: Fix failing test for freebsd for json

(10.6 backport)

Json test about max statement time fails with freebsd because on some
architectures the test might execute faster and the statement may not fail.

To simulate failure regardless of architecture, introduce a wait of seconds
longer than the max_statement_time.
Alexey Botchkov
MDEV-39750 ExtractValue does not control recursion depth.

Stack control added.
Daniel Black
MDEV-28404 JSON functions don't respect KILL QUERY

Or max_statement_time limit or MAX_DEPTH.

Correct interuptability and depth checking of:
* JSON_CONTAINS
* JSON_CONTAINS_PATH
* JSON_EXISTS
* JSON_EXTRACT
* JSON_KEYS
* ST_GeomFromGeoJSON

Populate in the json library the killed as a specific
error message. As the json library has a killed_ptr
is approprate it handles it.

As json_report_error now processes the killed there's
no need of thd->check_killed().

Verified that the path after every json_scan_next, the
location of checking the killed_ptr, reports errors
correctly.
Hemant Dangi
MDEV-35812: Galera SST fails with TLS certificate containing an intermediate CA

Issue:
Verify_ca_matches_cert ran "openssl verify -CAfile <ca> <cert>", which
treats only the first cert in the file as the target. For a leaf+intermediate
bundle against a root-only CA, openssl cannot reach the root, so the check
aborts the SST (exit 22).

Solution:
Pass the cert file as -untrusted so bundled intermediates complete
the chain to the CA. Trust anchor is unchanged (still -CAfile only).
Alexander Barkov
MDEV-39587 Package-wide TYPE for variable declarations

SET sql_mode=ORACLE;
DELIMITER $$
CREATE OR REPLACE PACKAGE pkg AS
  -- Declare a package public data type
  TYPE varchar_array IS TABLE OF VARCHAR(2000) INDEX BY INTEGER;
END;
$$
DELIMITER ;
DELIMITER $$

CREATE OR REPLACE PROCEDURE p1 AS
  v pkg.varchar_array; -- Use the package public data type
BEGIN
  v(0):='test';
  SELECT v(0);
END;
$$
DELIMITER ;

Note, the change is done only for sql_mode=ORACLE, because the TYPE
declaration is not available for the default mode.

Where package-wide types are available
--------------------------------------
- Variabe list type:
    DECLARE var pkg1.type1;

- RETURN type for a package routine:
    CREATE FUNCTION .. RETURN pkg1.type1 ...

- Parameter type for a package routine:
    PROCEDURE p1(param1 pkg1.type1);

- Assoc array element type:
    TYPE assoc1_t IS TABLE OF pkg1.type1 ...

- REF CURSOR RETURN type:
    TYPE cur1_t IS REF CURSOR RETURN pkg1.type1;

Change details
--------------

- Adding a member Lex_length_and_dec_st::m_foreign_module_type
  It's set to true when the data type was initialized from a TYPE
  in foreign routine (e.g. in PACKAGE spec).
  It's needed to prevent use of qualified identifiers in public contexts,
  i.e. in schema public routine parameter types and schema publuc function
  RETURN types.
  Adding a helper method sp_head::check_applicability() which prevents
  use of qualified types in public context.

- Adding a helper method sp_head::raise_unknown_data_type().

- Adding methods LEX::set_field_type_typedef_package_spec() for
  2-step and 3-step qualified indentifiers.
  It's used in field_type_all_with_typedefs which covers cases:
  - Variabe list type        : DECLARE var pkg1.type1;
  - RETURN type              : CREATE FUNCTION .. RETURN pkg1.type1 ...
  - Parameter type          : PROCEDURE p1(param1 pkg1.type1);
  - Assoc array element type : TYPE assoc1_t IS TABLE OF pkg1.type1 ...

- Adding a method LEX::declare_type_ref_cursor_return_typedef().
  It handles cases when a new TYPE REF CURSOR RETURN is declared,
  for both for qualified RETURN types and non-qualified RETURN types:
  - TYPE cur0_t IS REF CURSOR RETURN rec1_t;
  - TYPE cur0_t IS REF CURSOR RETURN pkg1.rec1_t;
  - TYPE cur0_t IS REF CURSOR RETURN db1.pkg1.rec1_t;

  The code was moved from LEX::declare_type_ref_cursor() into
  LEX::declare_type_ref_cursor_return_typedef() and extended
  to cover qualified RETURN types.

- Adding a method Sql_path::find_package_spec_type().
  It iterates through all schemas specified in @@path and searches
  for the given type in the given package.

- Adding a helper method sp_pcontext::type_defs_add_ref_cursor()
  to reuse the code.

- Adding a new method sp_package::get_typedef() to search
  for TYPE definitions in PACKAGE specifications.

- Adding a new method sp_head::get_typedef_package_spec()
  to search for TYPE definitions used by a PROCEDURE or FUNCTION.

- Adding a helper method
    Sp_handler::sp_cache_routine_reentrant_suppress_errors
  Adding a method Sp_handler::find_package_spec().
Alessandro Vetere
MDEV-40408 btr_page_reorganize_low() uses the buffer pool just to obtain a scratch block

Add a pool of scratch blocks, btr_scratch_pool_t, to be used instead
of the global buffer pool in the page-reorganization operations,
when a scratch block is needed.
Removes the needs of obtaining the buf_pool.mutex in such functions,
and any delay while holding at least page X-latch that it might have
caused.
Vladislav Vaintroub
MDEV-37000 disable optimization for Aria remove_key() on affected MSVC

The Aria remove_key() helper can miscompile in x64 MSVC builds when
optimization is enabled, leading to 'Index is corrupt' during DELETE.

Apply the same #pragma optimize("g", off) workaround already used in
MyISAM, and limit it to _MSC_VER >= 1930 && _MSC_VER < 1951.

The upper bound for affected MSVC is just the newest MSVC version in
VS2026, where the bug is no longer reproducible. Also, MSVC release notes
https://learn.microsoft.com/en-us/visualstudio/releases/2026/release-notes
list multiple fixes for 19.50 x64 optimizer and codegen bugs.
Daniel Black
MDEV-30518: JSON functions cannot be killed on big-endian (backport)

Backport to 10.6 without JSON_OVERLAPS

The json_engine killed_ptr was of type uchar however the enum
in the server is dependant on the architecture. On big-endian
architectures like IBM Z, retreiving a uchar* retreived the
unmodifed part of the THD->kill enum location and was always 0.

As C++11 allows enums to inherit a type, used uint32_t as the base
class of killed_state type in the server and used uint32_t in the
json library.

reload_acl_and_cache required an expression change to avoid
the compile error:
sql/sql_reload.cc:472:24: error: enumerated and non-enumerated
type in conditional expression [-Werror=enum-conversion]
  472 |  return result || (thd ? thd->killed : 0);

Added the kill_ptr assignment the following functions can be
killed:
* Item_func_json_depth::val_int
* Item_func_json_type::val_str
* Item_func_json_length::val_int

Item_func_json_array_append::val_str, check_killed() only applied
to json_error: label and not return_null.

Item_func_json_format::val_str(), corresponding to the SQL,
json_compact, json_detailed, json_loose - add debug instrumentation
for the func_json_notembedded test.

MDEV-26726 (fcd345de485f) added a json_pause_execution sync point
however the test case used debug_max_statement_time, which doesn't
exist. Fix the sync point name in the test.