Home - Waterfall Grid T-Grid Console Builders Recent Builds Buildslaves Changesources - JSON API - About

Console View


Categories: connectors experimental galera main
Legend:   Passed Failed Warnings Failed Again Running Exception Offline No data

connectors experimental galera main
fe3039eef7b8...
fe3039eef7b8b6d86458d9ef63554647d85dcd54
Sergei Golubchik
MDEV-39673 group_concat ignores max_allowed_packet

GROUP_CONCAT is limited by group_concat_max_len,
but also, as a string function it must respect max_allowed_packet.

Let's introduce THD::gconcat_max_len() helper to simplify checks.

Also:
* make max group_concat_max_len value the same as max max_allowed_packet
* use the same MY_MIN((ulonglong) ..., UINT_MAX32) in
  Item_func_json_objectagg as in Item_func_group_concat
* use overflow-safe type for lengths in Item_func_quote
  (MAX_MAX_ALLOWED_PACKET is 1G so uint cannot overflow yet, but it's
  a fragile assumption)
fda9d85c06ce...
fda9d85c06cebbb8a0e7d4a9cdf030d7ab85f36d
Daniel Black
MDEV-39813 ST_GeomFromGeoJSON does not control recursion depth

Geometry::create_from_json reset the killedptr and the stack
depth (stack_p) every time json_scan_start was called. We save/
restore these values so that the ST_GeomFrom_GeoJSON can be killed
and incur timeout, and also so that its depth measurement is kept.

Test case an bug report thanks to byteoverride.
fcd3f81e08da...
fcd3f81e08daea471d371d3be051e6feabb06399
Vladislav Vaintroub
MDEV-37556 Memory leak in proxy protocol with name resolution enabled

When proxy protocol is used and --skip-name-resolve is not set,
thd_set_peer_addr() is called twice per connection: once for the real TCP peer (in check_connection),
and again for the proxied address (in handle_proxy_header).
Each call invokes ip_to_hostname(), which allocates a hostname string
(unless loopback connection is used) and stores it as
thd->main_security_ctx.host. That code missed to free previously
allocated hostname, which results into memory leak.

This is now fixed. Also added debug-only test to mysql_client_test, which
fakes DNS and IP resolution the same way some perfschema tests do, to
emulate remote TCP connection in MTR.
f139e207175b...
f139e207175b5bbb9f8f0bc24227c61379746218
Jan Lindström
MDEV-40027 : Galera Cluster-peer > Donor command execution

An appropriately privileged user (with SUPER privileges) could
execute shell commands as the uid of the mariadbd process
because the values of the system variable wsrep_sst_auth,
which can be modified at runtime, were not properly
sanitized when used to construct a shell command.

Combined rsync and mariabackup test cases and added
test case for incorrect values for wsrep_sst_auth.
ed8404a73f93...
ed8404a73f93e79aff7227bb4560a44cbfdb5d1c
Hemant Dangi
MDEV-39721: wsrep_notify.cc: reject shell-unsafe characters in joiner-supplied member fields

Issue:
wsrep_notify_status() interpolated members[i].name() (the peer's
wsrep_node_name) and members[i].incoming() verbatim into a command
string that is then executed via 'sh -c' by wsp::process. A peer
joining the cluster with shell metacharacters in its wsrep_node_name
or wsrep_node_incoming_address caused arbitrary commands to run on
every cluster member that had wsrep_notify_cmd configured.
MDEV-39413 introduced safe() for the same threat class in the SST
scripts but did not cover the C++ wsrep_notify path.

Solution:
Validate each substituted field against a narrow whitelist before
interpolating. Node name allows alnum and -_. ; node address
additionally allows :[]/ for host:port and [ipv6] forms. On bad
input the notification is skipped with an error log instead of
forwarding the unsafe value to sh -c.
e558b406fe96...
e558b406fe96ee3eb91760ccb7bfb8c64e69106e
Daniel Black
MDEV-39276: Assertion `0` failed in json_find_path

This was resolved with MDEV-35548, however we add
two additional test cases.
de39d3031cbe...
de39d3031cbed70c03a36057fbc523d03cc112fb
Daniel Black
MDEV-39691 wsrep.cnf contains deprecated wsrep_causal_reads

wsrep_causal_reads was deprecated in 10.1.3 and removed in 11.3.1.
Put in place the equivalent (and default) wsrep_sync_wait=0.

Amend a few early comments to show MariaDB as our product.
dae315a7b2bf...
dae315a7b2bf8bd2fd0449467e711e5a2db26669
Hemant Dangi
MDEV-39648: wsrep_sst_rsync.sh: apply safe() to joiner-supplied parameters

Issue:
wsrep_sst_rsync.sh interpolated WSREP_SST_OPT_REMOTE_USER and
WSREP_SST_OPT_REMOTE_PSWD verbatim. Because both values originate from
the joiner side of the SST request, a newline in either could splice
an extra directive into the donor-written stunnel.conf (silently
downgrading peer-cert verification) or an extra line into the rsync
magic file. MDEV-39413 had introduced safe() for the same threat class
in wsrep_sst_mariabackup but did not extend it to the rsync script.

Solution:
Routing the rsync interpolations through safe() closes the gap, and
extending safe() to also reject tab and newline ensures multi-line
values cannot survive into a config-file heredoc.
d404a47c25b8...
d404a47c25b8d5d3b37d9d62c14311934523fd17
Teemu Ollakka
Add missing notify_state_change() in Wsrep_client_service.

The change was forgotten from previous rebase/wsrep-lib update.
b2050fdb4a87...
b2050fdb4a8776422baf01a41bf86845994edb97
Sergei Golubchik
strengthen safe() in wsrep_sst_common, just in case
aefe48e6ef95...
aefe48e6ef955947d139ff04488d6890034ed034
Marko Mäkelä
MDEV-39344: trx_disconnect_prepared() uses wrong mutex

trx_t::disconnect_prepared(): Replaces trx_disconnect_prepared().
Protect is_recovered, mysql_thd with mutex, to be consistent with
protecting fetch_data_into_cache_low().

This fixes up
commit c0817dac99c28698dfc2b548d89acf1fb41dc32e (MDEV-29575).

Suggested by: Sergey Vojtovich
a9e2f7f648f3...
a9e2f7f648f339c6f49b5bbe0435fa6b04a27ed2
Sergei Golubchik
MDEV-39676 disallow global.wsrep_sst_donor=NULL again

it crashes in galera.mdev-28433
a6a10baba9b4...
a6a10baba9b486799e76393c7a2d233291b8ba1b
jmestwa-coder
MDEV-40200 bound shift width in dyncol integer readers

The dynamic column integer decoders derive the shift exponent from the
data interval length without bounding it to the 64-bit type width.

dynamic_column_uint_read() loops over the interval doing
value+= data[i] << (i*8). A record whose integer column has an interval
longer than 8 bytes drives i*8 to 64 and past it, which is undefined and
aborts under -fsanitize=shift. dynamic_column_var_uint_get(), used for the
charset id of a string value and for the intg/frac of a decimal, has the
same defect: length*7 grows without bound over a run of 0x80 continuation
bytes.

Reject integers longer than 8 bytes with ER_DYNCOL_FORMAT, propagate that
through dynamic_column_sint_read(), and cap the varint loop at 10 groups.

To reproduce, build with -fsanitize=shift and read with COLUMN_GET() a
record whose integer column data interval exceeds 8 bytes; the shift
exponent reaches 64 in dynamic_column_uint_read(). A new case in the
ma_dyncol unit test crafts such a record and checks it is rejected.
9a3e15318816...
9a3e15318816616bbdbc2b83a8f7171fa4fd42f8
Sergei Golubchik
MDEV-39581 dynamic column header missing sanity checks
8eda90189340...
8eda90189340c31f7dfbae9ed870bfd8c0ad1776
Raghunandan Bhat
MDEV-39450: Memory corruption: overlapping memory ranges in `Field_longstr::compress` on UPDATE of compressed column

Problem:
  Values shorter than `column_compression_threshold` (default 100) are
  stored uncompressed. Reading such a column returns a pointer into that
  buffer rather than a copy.

  When the new value is a substring of the column that aliases this
  buffer at a non-zero offset, e.g. `RIGHT(c,n)` or `SUBSTRING(c,n)`,
  the source and destination overlap, and the `memcpy()` in the "store
  uncompressed" path copies overlapping regions, which is undefined
  behaviour.

Fix:
  Replace `memcpy` with `memmove` to avoid copying between overlapping
  memory regions.
8b27beead627...
8b27beead6277f1fc15a750f7c226be3761e14cc
Jan Lindström
MDEV-40056 : Analyze Galera Dynamic Variables Susceptible to RCEs

Fix potential issue with wsrep_node_address by allowing
only correctly constructed address.
8a7be7e9aac2...
8a7be7e9aac2ea79cd6ae63baab8ff547c1e3da9
Hemant Dangi
MDEV-38843: BF applier failed on a node causing complete Cluster lockup

Issue:
When a BF applier failed to apply a write set and the transaction
rollback returned non-zero, wsrep-lib's apply_write_set() short-circuited
log_dummy_write_set(). That call releases commit order through
commit_order_leave() -- which drives the inconsistency vote -- and
advances the storage engine checkpoint. Skipping it left the seqno stuck
in commit order, so following appliers blocked on commit_order_enter and
the node silently locked the cluster while staying in the primary
component.

Solution:
wsrep-lib now always calls log_dummy_write_set() on the apply-error path,
so the apply error reaches the provider and the node is voted out and
evicted instead of hanging. The rollback result is still folded into ret,
and Wsrep_high_priority_service::rollback() returns its real result again.
85ab366da3fc...
85ab366da3fc5d13b61d9e491e63e2b62c017cf4
Luke Lu
MDEV-39689: Fix OOB reads in Table_map_log_event parsing

Add bounds checks to prevent out-of-bounds memory reads when parsing
Table_map_log_event optional metadata and constructor fields.

The checks prevent OOB reads but do not attempt to throw errors for
every possible corruption. Replication fundamentally assumes a trusted
source with valid data. The goal here is hardening against accidental
corruption (truncated events, garbled metadata lengths). On detecting
corruption, the slave either falls back gracefully to positional column
mapping (parse_* functions) or rejects the event entirely (constructor),
rather than crashing or leaking heap contents via OOB reads.

parse_* functions: Add if (unlikely(p > end)) return after every
net_field_length() call. Ensures decoded values are validated before
being stored to struct fields, preventing information disclosure from
OOB reads. On early return, the slave gracefully falls back to
positional column mapping.

Table_map_log_event constructor: Add bounds checks before memcpy calls
for m_colcnt, m_field_metadata_size, and m_null_bits. On overflow, frees
allocated memory and sets m_memory=NULL causing is_valid() to return
false. Adds read-side DBUG_EXECUTE_IF injection points for testing.

Functions fixed:
- parse_default_charset
- parse_column_charset
- parse_column_name
- parse_set_str_value
- parse_geometry_type
- parse_simple_pk
- parse_pk_with_prefix
- Table_map_log_event constructor (m_colcnt, m_field_metadata, m_null_bits)

MTR test rpl_table_map_log_event_overflow covers all affected code paths
with 9 test cases using debug injection.
760b57814f01...
760b57814f010d66f53ee5e7f885035180ff609b
Daniel Bartholomew
bump the VERSION
736edbe77ce5...
736edbe77ce5db44ea38347280f77d6a304fa3ae
Oleksandr Byelkin
MDEV-40159: single quote in DATA DIRECTORY breaks SHOW CREATE TABLE

Correct append function called for value in quotes
70a88a6b6e11...
70a88a6b6e11d3cb840d5b27d05d967aff099ef0
Thirunarayanan Balathandayuthapani
MDEV-34998 Assertion `n_fields > n_cols || type & 32' failed in dict_index_t::init_change_cols on ALTER

Problem:
=======
During ALTER TABLE with column type modification and index addition,
InnoDB aborts with an assertion failure when processing collation
changes for single-column secondary indexes.

Solution:
========
dict_index_t::init_change_cols(): A single-column prefix secondary
index can have n_cols == n_fields when the column is the same as
the primary key column and undergoes a collation or type change
during ALTER TABLE.
687794841554...
687794841554696037a03fd63ca6f24532431b1c
Vladislav Vaintroub
MDEV-14443 DENY statement

Implements DENY/REVOKE DENY and associated tasks.
680319ca3683...
680319ca3683f7278db4e0f2e911d9ac4b4ba72e
forkfun
new wolfssl v5.9.2-stable
635e24dbdfc9...
635e24dbdfc97ecd94a44b563bd3082075f97c49
Raghunandan Bhat
MDEV-40316: Infer: PULSE_RESOURCE_LEAK in connect

Problem:
  Infer found file descriptors left open on some error code paths in
  connect storage engine.

Fix:
  Close file descriptors on error before returning.
5cedbdfcc65b...
5cedbdfcc65b07d15ab25164cdce677cf0d256fa
Sergei Golubchik
fix columnstore for new cmake
5a38a85de596...
5a38a85de5968ac7ce460dedfd046fe9fecdc1b7
Vladislav Vaintroub
MDEV-39047 Impossible to create DB grant for long escaped DB name

The database name in GRANT is stored in mysql.db.Db, which holds 64
characters. Escaping '_' or '%' with a backslash to match them literally
can make the stored name longer than 64 characters, and it was silently
truncated into a non-functional grant. Reject it with ER_WRONG_DB_NAME
instead, the same error CREATE DATABASE gives for an over-long name.
52bbe5b6e7fe...
52bbe5b6e7fe274f0c4738685326283c0d65944d
Sergei Golubchik
MDEV-39658 ASAN crash on invalid proxy_protocol_networks value

max_subnet estimate was off by one.

* only allow address with a known family
  (trips an assert in addr_matches_subnet())
* adjust max_subnet estimate accordinly
526cf61d009e...
526cf61d009e42bc3ac7de259fa3ed1d34b3405d
Daniel Black
MDEV-39829/MDEV-33532 s3.debug test failure

MDEV-39516 corrected the interface with curl particularly around
passing options.

After this the s3.debug actually enabled curl debugging like is
was meant to. With this enabled, there are addition s3_test_ pattens
in the result file, from the error log where curl correctly provide
debug message.

ps-protocol test also failed under MDEV-33532 where a differnet
number of entries was recored.

Correct variations by using the $database/$table rather than just the
s3_test_ pattern.

As the purpose of this test is to check if s3_debug is dynamic, the
second part of the test searches for a previously, under s3_debug=1,
table t2 interaction, where the results should be NOT_FOUND.

Remove count from the result file to allow for different curl versions
and the possibiliy of being run under ps-protocol.
3ff8c1a937ac...
3ff8c1a937aca7e707ecd64f7c51f12e46c72649
Raghunandan Bhat
MDEV-38075: Make sysV init script check for actual function presence

Problem:
  The current implementation of the sysvinit script only creates
  `log_success_msg()` and `log_failure_msg()` fallback functions when
  not finding an /etc/init.d/functions file to include.

  Newer RHEL releases do not define those functions in that file
  anymore.

Fix:
  Check if the functions are defined and provide fallback functions if
  they are not defined.
37168ce87cb6...
37168ce87cb663a008ded487b7f0e1be5b88ca20
Brandon Nesterenko
MDEV-39710: Update git modules WSREP Links to mariadb-corporation

The .gitmodules file still uses the old Codership Github repo link. This
redirects to the mariadb-corporation repo, so it isn't a functional
problem, but it should still be updated to the correct repo.

Reviewed-by: Teemu Ollaka <[email protected]>
34fd0fedc5f3...
34fd0fedc5f3b612958b4a88bcc083a4bfd2ebd8
Marko Mäkelä
MDEV-39344: fetch_data_into_cache() clears "is_truncated"

There is a memory limit implemented for the INFORMATION_SCHEMA tables
innodb_trx, innodb_locks, innodb_lock_waits. The predicate
trx_i_s_cache_is_truncated() would never hold in
trx_i_s_common_fill_table() due to a logic bug that had been
introduced in a refactoring.

fetch_data_into_cache(): Shrink the critical section of lock_sys.latch
and do not unconditionally reset cache->is_truncated when leaving the
function. This fixes a correctness regression that had been introduced
back in 2007 by commit 5cbf4e3840491c2d80928641bc0fbb8135e9c201
for the InnoDB Plugin for MySQL 5.1, which later became
the built-in InnoDB in MySQL 5.5 and MariaDB Server 5.5.

Reviewed by: Sergey Vojtovich
32ab8a2d4c0f...
32ab8a2d4c0fd04e89713f63f04c6cf40248b63d
Sergei Golubchik
MDEV-39657 ASAN error on malformed WKB point

check data length for Gis_point
2f46361ed6dc...
2f46361ed6dc1ed68b4aca3a909c3ca079fb3274
Daniel Black
MDEV-37615: Clang based static analysis false postive reports on UNINIT_VAR

Clang upstream bug https://github.com/llvm/llvm-project/issues/173210
shows that a "int x=x" construct will in the intermediate representation
have code to read from x. With this generated sanitizer=undefined and
static analyzers will all see the uninitialized read and write.

Because clang has a stronger implementation of following paths to
uninitialized variables, "#define UNINIT_VAR(x) x" is the which
is what our release binaries use is the ideal path for this compiler.

Clang based compilers with error during compilation if any
uninitialized behaviour is detected at compile time because of
0c80ddb519bd06efbd7ccf2a2487b2503cd16db5.

Corrects MDEV-36542 - 6fd57f478f585249bdca242b1576ac0a7bd7aacf.
2c40efe5c042...
2c40efe5c042b5a4e72f54331a6b5b3711f52bb3
Daniel Black
spelling correction: support-files/wsrep.cnf.sh

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
29417cfe3770...
29417cfe37709092c7af7dde1ae474c480669a51
Rucha Deodhar
MDEV-32726: Fix failing test for freebsd for json

(10.6 backport)

Json test about max statement time fails with freebsd because on some
architectures the test might execute faster and the statement may not fail.

To simulate failure regardless of architecture, introduce a wait of seconds
longer than the max_statement_time.
265bf3a9b10d...
265bf3a9b10d064d14b7bfc702b47c51b8863962
Alexey Botchkov
MDEV-39750 ExtractValue does not control recursion depth.

Stack control added.
24ee5fd6bf60...
24ee5fd6bf6065ea693287e5705f3e26bb85f9fc
Daniel Black
MDEV-28404 JSON functions don't respect KILL QUERY

Or max_statement_time limit or MAX_DEPTH.

Correct interuptability and depth checking of:
* JSON_CONTAINS
* JSON_CONTAINS_PATH
* JSON_EXISTS
* JSON_EXTRACT
* JSON_KEYS
* ST_GeomFromGeoJSON

Populate in the json library the killed as a specific
error message. As the json library has a killed_ptr
is approprate it handles it.

As json_report_error now processes the killed there's
no need of thd->check_killed().

Verified that the path after every json_scan_next, the
location of checking the killed_ptr, reports errors
correctly.
160695101c17...
160695101c171378b5a35972cc042be076e23776
Marko Mäkelä
MDEV-39344: Fix a TOCTOU race

trx_i_s_possibly_fetch_data_into_cache(): Fetch into the cache and
return whether the cache was truncated. Previously, we checked this
flag without holding any latch.

trx_i_s_cache_start_write(), trx_i_s_cache_end_write(),
trx_i_s_cache_is_truncated(): Remove. These are now part of
trx_i_s_possibly_fetch_data_into_cache().

trx_i_s_cache: Remove. The singleton cache object can be a static object
with no pointer indirection.
11c41cd93d2c...
11c41cd93d2c3732862ba043afd18508021440c0
Sergei Golubchik
MDEV-39622 OBJECT_INSTANCE_BEGIN in P_S are unstable, difficult to compare

let's show stable values that don't change between runs
0ff2fda7b3bc...
0ff2fda7b3bc26ffdbf5de1d4c9268625486f755
Daniel Black
MDEV-30518: JSON functions cannot be killed on big-endian (backport)

Backport to 10.6 without JSON_OVERLAPS

The json_engine killed_ptr was of type uchar however the enum
in the server is dependant on the architecture. On big-endian
architectures like IBM Z, retreiving a uchar* retreived the
unmodifed part of the THD->kill enum location and was always 0.

As C++11 allows enums to inherit a type, used uint32_t as the base
class of killed_state type in the server and used uint32_t in the
json library.

reload_acl_and_cache required an expression change to avoid
the compile error:
sql/sql_reload.cc:472:24: error: enumerated and non-enumerated
type in conditional expression [-Werror=enum-conversion]
  472 |  return result || (thd ? thd->killed : 0);

Added the kill_ptr assignment the following functions can be
killed:
* Item_func_json_depth::val_int
* Item_func_json_type::val_str
* Item_func_json_length::val_int

Item_func_json_array_append::val_str, check_killed() only applied
to json_error: label and not return_null.

Item_func_json_format::val_str(), corresponding to the SQL,
json_compact, json_detailed, json_loose - add debug instrumentation
for the func_json_notembedded test.

MDEV-26726 (fcd345de485f) added a json_pause_execution sync point
however the test case used debug_max_statement_time, which doesn't
exist. Fix the sync point name in the test.
BuildBot (0.8.9) working for the MariaDB project.
Page built: Mon 20 Jul 2026 10:10:31 (UTC)