Home - Waterfall Grid T-Grid Console Builders Recent Builds Buildslaves Changesources - JSON API - About

Console View


Categories: connectors experimental galera main
Legend:   Passed Failed Warnings Failed Again Running Exception Offline No data

connectors experimental galera main
fd840f103a37...
fd840f103a37a123dadf6d3c7be540c2f62e031d
Sergei Golubchik
MDEV-41803 mariadb-binlog --raw takes the output file name from Rotate events without checking it

mariadb-binlog --raw appended the file name from a Rotate event to the
--result-file prefix, so a malicious server could make it write files
outside that directory.

Reject a Rotate event file name with a directory component - a
legitimate server only puts a bare file name in the Rotate event

Assisted-by: Claude:claude-opus-5-5
f574ec9b1cde...
f574ec9b1cde7b9f000726db59bd8c5a690a36ba
Sergei Golubchik
MDEV-41808 repeated CTE references keep reparsing exponentially on time and memory

Every reference to a CTE after the first re-parses its specification and
recursively resolves the references inside the clone, so a chain of CTEs
each referencing the previous one twice expands to 2^N re-parses from
linear-size SQL, exhausting CPU and memory at parse time.

Bound the number of specification clones per statement.

Assisted-by: Claude:claude-opus-4-8
ec6bc35f5747...
ec6bc35f57479571df6428d1c7c0444caae8a500
Sergei Golubchik
wip: versioning.rpl_row 'row'

CURRENT_TEST: versioning.rpl_row
mysqltest: At line 145: query 'set statement sql_log_bin=0 for
create table t (id int primary key, a int, unique (a))
engine=innodb with system versioning' failed: ER_TABLE_EXISTS_ERROR (1050): Table 't' already exists
ea1aecf6a445...
ea1aecf6a44504f5d37a3ae24d3547d4e632271d
Sergei Golubchik
cleanup: undefined function declarations
d96d42de2b2f...
d96d42de2b2f3639027a11c72cdec54aa18d9ba7
Sergei Golubchik
UndefinedBehaviorSanitizer: nullptr-with-nonzero-offset rdb_datadic.cc:558
cee1c9ebfffe...
cee1c9ebfffe49f3520406e81a8f94ec23d17a71
Sergei Golubchik
CONNECT: reset vptr before writing an object to a file

pointers make no sense there
c42b86171959...
c42b86171959971a74a8efbfd89a616421a3262a
Sergei Golubchik
CONNECT: json_bson_file_priv test fails in MSAN

1.
the fix for MDEV-41613 added the first ever test for jfile_bjson().
this UDF allocates structures on the heap and dumps them to a file
with fwrite(). Structures may have padding, bytes in padding stay
not initialized and MSAN gets unhappy when they're fwritten.

Let's clear the allocated memory area for file-writing UDFs

2.
jbin_set_item sends BSON structure as blob in the result set.
So this structure must not have uninitialized bytes either.
c3154f9b4137...
c3154f9b4137648f845ddf2161e40a5d69d3c456
Sergei Golubchik
fix RPAD(), LPAD() and INSERT() not to mangle its arguments

they used to overwrite the charset of their arguments, this is
incorrect and led to wrong results
b1a38802f3a2...
b1a38802f3a24355f786c9a4bcd76baa405151ea
Sergei Golubchik
cleanup: CONNECT rest.test

no need to run the same CREATE TABLE twice, first to check if it works
and then to test its result
a881d5fa1252...
a881d5fa1252584bc9e6bccd370f960d260af58b
Sergei Golubchik
MDEV-41804 deeply nested ROWs crash

add check_stack_overrun()
a396d490d6ed...
a396d490d6edf0d6678d7862d611c313b2232549
Miroslav Rajcic
Bug#39905057: MySQL ExtractValue unclosed CDATA length underflow causes mysqld heap overflow / crash

Problem:
========
The XML scanner reports an unterminated <![CDATA[ section as a valid
CDATA token. Its end pointer remains at the opening delimiter, while
the parser unconditionally removes the opening and closing delimiters.

This underflows the value length. ExtractValue() can subsequently pass
that length to String::append(), causing a heap overwrite and mysqld
crash.

Root Cause:
===========
my_xml_scan() only sets the token end when it finds ]]>, but
my_xml_parse() assumes every CDATA token is complete.

Solution:
=========
Detect EOF before the CDATA terminator and return a parse error before
calling the XML value handler.

Add an ExtractValue() regression test verifying that unterminated CDATA
is rejected with a warning.

Change-Id: I142bafd9ddea185f6b2e87a80af4894f10168291

Fixes MDEV-39571, MDEV-41407
9a11e65f148d...
9a11e65f148d313c0cb18235a0f4a304db9f71c4
Sergei Golubchik
wip: versioning.rpl_row 'row'

CURRENT_TEST: versioning.rpl_row
mysqltest: At line 145: query 'set statement sql_log_bin=0 for
create table t (id int primary key, a int, unique (a))
engine=innodb with system versioning' failed: ER_TABLE_EXISTS_ERROR (1050): Table 't' already exists
9837d318849d...
9837d318849d902205dd44cabd52489f66d84c4d
Sergei Golubchik
MDEV-41803 mariadb-binlog --raw takes the output file name from Rotate events without checking it

mariadb-binlog --raw appended the file name from a Rotate event to the
--result-file prefix, so a malicious server could make it write files
outside that directory.

Reject a Rotate event file name with a directory component - a
legitimate server only puts a bare file name in the Rotate event

Assisted-by: Claude:claude-opus-5-5
96218b1569e9...
96218b1569e923abad7840fcc407b939e87aefa0
Sergei Golubchik
MDEV-41496 OOB write with RPAD() crash and multi-byte charsets and uservar

Item's charset is metadata, it's known at fix_fields and does not
change later. User variables can violate this invariant if they're
changed and used in the same query.

Let's always wrap such variables in Item_func_conv_charset()
to make sure the caller always gets the same fixed charset, no matter
what the actual variable value is.

Variables that aren't changed in the same query do not get this
unnecessary conversion.

Note that in --ps the charset might resolve differently. This is not a
bug, querying and modifying a user variable in the same query is a
documented UB. But both in nm and in ps both arguments of RPAD() always
have the same charset, so the result is internally consistent and
there's no OOB access.
87b6d7e6528d...
87b6d7e6528dcc0fe32dd377d401a6e4ed663f1f
Oleksandr Byelkin
MDEV-40727 fix galera.MDEV-40727 on symlinked vardir and non-Linux

The SST script logs physical paths, so the search failed when the
vardir is a symlink (e.g. to /dev/shm). Match only the part below the
vardir, run the test on Linux only (elsewhere nothing is logged), and
suppress node_2's warning on the replicated DROP of the shared file.
813930e05f01...
813930e05f0142ee853cef9d94441d862be2efca
Sergei Golubchik
connect.json_bson_file_priv fails in --cursor

udf should set max_length large enough to fit the error message
6dcb92277f36...
6dcb92277f3640b2f83433d156135a4d8c044f29
Oleksandr Byelkin
MDEV-39306 fix race in versioning.rpl_row

The slave created table t before the master's previous DROP TABLE t
was replicated. Sync the slave after the drops.
650f8a7095ef...
650f8a7095ef7bc8dfc851365894d93adf9e5a80
Sergei Golubchik
MDEV-41622 INSERT crashes on deeply nested GeometryCollection

- get_data_size() and init_from_wkb() return their error values on
  stack overrun, not a valid-looking length
- add stack checks to the remaining recursive GeometryCollection
  methods: wkt, json, mbr, area, length, dimension, store_shapes
- test non-GEOMETRY column and SELECT paths

Assisted-by: Claude:claude-opus-5-5
650a61886203...
650a61886203236d423ebe7ee1f296b8faba7640
Lawrin Novitsky
CONCPP-173 Wtrong display size for string data with MySQL server

The fix removes own array with collation's max char len data and makes
use of C/C API for that.
Existing tests cover this case.

Also the patch removes large family of assertTrue for integer and
floating poing types and substitutes them w/ templated functions.
Also introduced ASSERT_ONEOF(result, expected1, ...) to look up values
in the given set of possible values. This allows to have ht compared
value in the output in case this assertion fails.
  • ccpp-sles12-amd64: build linux-connector_cpp failed -  stdio
61ca0c2a5812...
61ca0c2a5812f674a15cd073fae463fb528f56aa
Sergei Golubchik
MDEV-41808 repeated CTE references keep reparsing exponentially on time and memory

Every reference to a CTE after the first re-parses its specification and
recursively resolves the references inside the clone, so a chain of CTEs
each referencing the previous one twice expands to 2^N re-parses from
linear-size SQL, exhausting CPU and memory at parse time.

Bound the number of specification clones per statement.

Assisted-by: Claude:claude-opus-4-8
611ecc816f76...
611ecc816f76fd5bff16f71dca8cd9588c2eb00f
Sergei Golubchik
fix RPAD(), LPAD() and INSERT() not to mangle its arguments

they used to overwrite the charset of their arguments, this is
incorrect and led to wrong results
5f6f5c7ef580...
5f6f5c7ef58046708fee4ca38e0969bcc46dfe30
Sergei Golubchik
connect.json_bson_file_priv fails in --cursor

udf should set max_length large enough to fit the error message
5991752f4926...
5991752f4926e31d58e9e2fbd89ddcfa8f8f25f6
Sergei Golubchik
Xcurl

* drop the redundant linux-only check "does curl exist?", let it
  fail as on Windows, when curl is executed (also that branch
  was missing one pclose())
* use _exit() not exit() - see `man vfork`
* on linux: wait for the correct (!) child to exit, don't ignore
  its failures (Windows code didn't)
* rephrase awkward message
57931c6814f0...
57931c6814f0a624b124ff09ad4644c973ca8cd5
Sergei Golubchik
MDEV-41801 "performance_schema" is compared case-sensitively in the engine, case-insensitively elsewhere

With lower_case_table_names=0 the performance_schema engine discovered
its tables only under the exact name, while ACL checks, is_perfschema_db()
and mariadb-dump matched the name case-insensitively. A database named,
for example, PERFORMANCE_SCHEMA was an ordinary database that got
performance_schema access rules.

Compare the name case-insensitively in the engine too.

Assisted-by: Claude:claude-opus-5-5
5718860413aa...
5718860413aa81bcd842147601a030936e02f02d
Sergei Golubchik
MDEV-41496 OOB write with RPAD() crash and multi-byte charsets and uservar

Item's charset is metadata, it's known at fix_fields and does not
change later. User variables can violate this invariant if they're
changed and used in the same query.

Let's always wrap such variables in Item_func_conv_charset()
to make sure the caller always gets the same fixed charset, no matter
what the actual variable value is.

Variables that aren't changed in the same query do not get this
unnecessary conversion.

Note that in --ps the charset might resolve differently. This is not a
bug, querying and modifying a user variable in the same query is a
documented UB. But both in nm and in ps both arguments of RPAD() always
have the same charset, so the result is internally consistent and
there's no OOB access.
56947c982632...
56947c982632e7e7791ce1e7107037617ea8e68f
Sergei Golubchik
fix versioning.rpl_row 'row'

mysqltest: At line 145: query 'set statement sql_log_bin=0 for
create table t (id int primary key, a int, unique (a))
engine=innodb with system versioning' failed: ER_TABLE_EXISTS_ERROR (1050): Table 't' already exists

make sure `drop table t` propagates before creating a new table t
534b0a9e2787...
534b0a9e2787b2e88622bcb71350e130b6250d76
Sergei Golubchik
cleanup: undefined function declarations
52a5cedc02dc...
52a5cedc02dc2d71a53d7af3671afc0725e83f79
Sergei Golubchik
MDEV-41458 Assertion `n > 0 && n < SINUSES_CALCULATED*2+1' failed in get_n_sincos()

With tiny *ex and *ey the sum of squares underflows and q becomes inf,
use hypot() which is under- and overflow safe.

Also, fix ab/(d*d) divison, for good measure
4f4aed13c810...
4f4aed13c8100f4b2926348bc3a25dff97f4ebcc
Sergei Golubchik
cleanup: CONNECT use a local HTTP server in connect.rest

The test depended on an external site, so it was slow and unreliable.
Serve std_data/bios.json from a forked perl server instead.

Assisted-by: Claude:claude-opus-5-5
4e91bfe3d5ba...
4e91bfe3d5ba5ac2460c2d6bb3e3c58f7ec65f2f
Sergei Golubchik
CONNECT: reset vptr before writing an object to a file

pointers make no sense there
4b748f162e96...
4b748f162e962cdeb0735d0b1af0744da14b9023
Sergei Golubchik
MDEV-41622 INSERT crashes on deeply nested GeometryCollection

- get_data_size() and init_from_wkb() return their error values on
  stack overrun, not a valid-looking length
- add stack checks to the remaining recursive GeometryCollection
  methods: wkt, json, mbr, area, length, dimension, store_shapes
- test non-GEOMETRY column and SELECT paths

Assisted-by: Claude:claude-opus-5-5
469be45dbfa1...
469be45dbfa16cb7f3b4f195b0a9e119820003e2
Sergei Golubchik
Xcurl

* drop the redundant linux-only check "does curl exist?", let it
  fail as on Windows, when curl is executed (also that branch
  was missing one pclose())
* use _exit() not exit() - see `man vfork`
* on linux: wait for the correct (!) child to exit, don't ignore
  its failures (Windows code didn't)
* rephrase awkward message
41b924947f32...
41b924947f32bc3a76bcfcaa750e8683de78e30a
Oleksandr Byelkin
MDEV-40386 DuckDB configure fails in rpm builds

DuckDB's configure checks link with -specs=redhat-package-notes but
without the RPM_* environment, and the linker launcher list was split
into separate cmake arguments. Run DuckDB's cmake under the launcher's
env and pass the launcher with a non-";" list separator.
40e8720d1230...
40e8720d12309f3b60c1efe01f171ae70913d934
Miroslav Rajcic
Bug#39905057: MySQL ExtractValue unclosed CDATA length underflow causes mysqld heap overflow / crash

Problem:
========
The XML scanner reports an unterminated <![CDATA[ section as a valid
CDATA token. Its end pointer remains at the opening delimiter, while
the parser unconditionally removes the opening and closing delimiters.

This underflows the value length. ExtractValue() can subsequently pass
that length to String::append(), causing a heap overwrite and mysqld
crash.

Root Cause:
===========
my_xml_scan() only sets the token end when it finds ]]>, but
my_xml_parse() assumes every CDATA token is complete.

Solution:
=========
Detect EOF before the CDATA terminator and return a parse error before
calling the XML value handler.

Add an ExtractValue() regression test verifying that unterminated CDATA
is rejected with a warning.

Change-Id: I142bafd9ddea185f6b2e87a80af4894f10168291

Fixes MDEV-39571, MDEV-41407
319db35becfa...
319db35becfa2708c3829a12c1ec8d6181d51738
Sergei Golubchik
UndefinedBehaviorSanitizer: nullptr-with-nonzero-offset rdb_datadic.cc:558
1cb08e466d95...
1cb08e466d95289bbde3b28e5de3d47f83a1b088
Sergei Golubchik
MDEV-41801 "performance_schema" is compared case-sensitively in the engine, case-insensitively elsewhere

With lower_case_table_names=0 the performance_schema engine discovered
its tables only under the exact name, while ACL checks, is_perfschema_db()
and mariadb-dump matched the name case-insensitively. A database named,
for example, PERFORMANCE_SCHEMA was an ordinary database that got
performance_schema access rules.

Compare the name case-insensitively in the engine too.

Assisted-by: Claude:claude-opus-5-5
0de274eb491c...
0de274eb491c60225c868c29402de56373d8f890
Sergei Golubchik
MDEV-41458 Assertion `n > 0 && n < SINUSES_CALCULATED*2+1' failed in get_n_sincos()

With tiny *ex and *ey the sum of squares underflows and q becomes inf,
use hypot() which is under- and overflow safe.

Also, fix ab/(d*d) divison, for good measure
0dbec505d7b0...
0dbec505d7b0749afef924077db9e89d0e1337a9
Sergei Golubchik
fixup! CONNECT: json_bson_file_priv test fails in MSAN
0b10c80c7df0...
0b10c80c7df06b526084c20659f53bf15e6b71c2
Sergei Golubchik
MDEV-41804 deeply nested ROWs crash

add check_stack_overrun()
0a0ffe039241...
0a0ffe0392412e070d15f2cb1dacbbcfc700209a
Sergei Golubchik
CONNECT: json_bson_file_priv test fails in MSAN

1.
the fix for MDEV-41613 added the first ever test for jfile_bjson().
this UDF allocates structures on the heap and dumps them to a file
with fwrite(). Structures may have padding, bytes in padding stay
not initialized and MSAN gets unhappy when they're fwritten.

Let's clear the allocated memory area for file-writing UDFs

2.
jbin_set_item sends BSON structure as blob in the result set.
So this structure must not have uninitialized bytes either.
BuildBot (0.8.9) working for the MariaDB project.
Page built: Sun 25 Oct 2026 23:12:13 (UTC)