summaryrefslogtreecommitdiff
path: root/include
Commit message (Collapse)AuthorAgeFilesLines
* Merge remote-tracking branch 'origin/5.5' into 10.0Vicențiu Ciorbaru2017-07-252-5/+4
|\
| * Merge remote-tracking branch 'mysql/5.5' into 5.5Sergei Golubchik2017-07-182-1/+2
| |\
| | * BUG#25451091:CREATE TABLE DATA DIRECTORY / INDEX DIRECTORYNisha Gopalakrishnan2017-05-121-2/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | SYMLINK CHECK RACE CONDITIONS ANALYSIS: ========= A potential defect exists in the handling of CREATE TABLE .. DATA DIRECTORY/ INDEX DIRECTORY which gives way to the user to gain access to another user table or a system table. FIX: ==== The lstat and fstat output of the target files are now stored which help in determining the identity of the target files thus preventing the unauthorized access to other files.
| | * BUG#25575605: SETTING --SSL-MODE=REQUIRED SENDS CREDENTIALS BEFORE VERIFYING ↵Ramil Kalimullin2017-03-132-2/+5
| | | | | | | | | | | | | | | | | | SSL CONNECTION Changed MYSQL_OPT_SSL_MODE to be the same as in 5.6 (ABI compatibility).
| | * BUG#25575605: SETTING --SSL-MODE=REQUIRED SENDS CREDENTIALS BEFORE VERIFYING ↵Ramil Kalimullin2017-03-105-9/+19
| | | | | | | | | | | | | | | | | | | | | SSL CONNECTION MYSQL_OPT_SSL_MODE option introduced. It is set in case of --ssl-mode=REQUIRED and permits only SSL connection.
| | * BUG#24807826: UINT3KORR SHOULD STOP READING FOUR INSTEAD OFKarthik Kamath2017-03-091-11/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | THREE BYTES ON X86 Analysis: ========= The macro uint3korr reads 4 bytes of data instead of 3 on on x86 machines. Multiple definitions were created for this macro for optimization in WIN32. The idea was to optimize reading of 3 byte ints by reading an ordinary int and masking away the unused byte. However this is an undefined behavior. It will be an issue unless users are aware of allocating an extra byte for using this macro. Fix: ==== Removing the definition which reads 4 bytes of data. The only definition of this macro would now read just 3 bytes of data thus prohibiting the usage of an extra byte. Note: ===== This is a backport of Patches #5 and #6 for Bug#17922198.
| * | MDEV-12144 Signal 6 crash corrupts ibd filesSergei Golubchik2017-07-151-3/+2
| | | | | | | | | | | | | | | Avoid using STDERR_FILENO. The server uses freopen(stderr), so stderr can be on any file descriptor.
* | | MDEV-11896 thd_get_error_context_description race conditionSergei Golubchik2017-07-201-1/+1
| | | | | | | | | | | | | | | | | | Change the semantics of thd_get_error_context_description(). It no longer expects the caller to lock LOCK_thread_count (no caller ever did that anyway), but takes care of it internally.
* | | Merge branch '5.5' into 10.0Sergei Golubchik2017-06-281-0/+2
|\ \ \ | |/ /
| * | MDEV-13187 incorrect backslash parsing in clientsSergei Golubchik2017-06-271-0/+2
| | | | | | | | | | | | cover ANSI_QUOTES and NO_BACKSLASH_ESCAPES in mysqltest
* | | MDEV-12420 max_recursive_iterations did not prevent a stack-overflow and ↵Sergei Golubchik2017-05-151-3/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | segfault post-review fixes * move pcre-specific variable out of mysys * don't use current_thd * move a commonly used macro to my_sys.h * remove new sysvar
* | | WIP: global readonly variable pcre_frame_sizeDaniel Black2017-05-151-0/+3
| | |
* | | Merge branch '5.5' into 10.0Sergei Golubchik2017-04-212-4/+3
|\ \ \ | |/ /
| * | MDEV-12230 include/my_sys.h:600:43: error: unknown type name ↵Sergei Golubchik2017-04-202-2/+48
| | | | | | | | | | | | | | | | | | ‘PSI_file_key’" when -DWITHOUT_SERVER=1 cherry-pick 2c2bd8c155 (MDEV-12261 build failure without P_S) from 10.0
| * | Merge remote-tracking branch 'mysql/5.5' into 5.5mariadb-5.5.55Sergei Golubchik2017-04-111-3/+3
| |\ \
| | * | BUG#25575605: SETTING --SSL-MODE=REQUIRED SENDS CREDENTIALS BEFORE VERIFYING ↵Ramil Kalimullin2017-03-142-2/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | SSL CONNECTION Changed MYSQL_OPT_SSL_MODE to be the same as in 5.6 (ABI compatibility). (cherry picked from commit 47bb4eb5df1629b5d5e30aebfa9d7a6d74388a5d)
| | * | BUG#25575605: SETTING --SSL-MODE=REQUIRED SENDS CREDENTIALS BEFORE VERIFYING ↵Ramil Kalimullin2017-03-105-9/+19
| | |/ | | | | | | | | | | | | | | | | | | | | | | | | SSL CONNECTION MYSQL_OPT_SSL_MODE option introduced. It is set in case of --ssl-mode=REQUIRED and permits only SSL connection. (cherry picked from commit 3b2d28578c526f347f5cfe763681eff365731f99)
| | * Updated copyright year in user visible textBalasubramanian Kandasamy2017-01-061-2/+2
| | |
| | * BUG#24437124: POSSIBLE BUFFER OVERFLOW ON CREATE TABLEKarthik Kamath2016-11-101-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ANALYSIS: ========= 'CREATE TABLE' query with a large value for 'CONNECTION' string reports an incorrect error. The length of connection string is stored in .frm in two bytes (max value= 65535). When the string length exceeds the max value, the length is truncated to fit the two bytes limit. Further processing leads to reading only a part of the string as the length stored is incorrect. The remaining part of the string is treated as engine type and hence results in an error. FIX: ==== We are now restricting the connection string length to 1024. An appropriate error is reported if the length crosses this limit. NOTE: ===== The 'PASSWORD' table option is documented as unused and processed within a dead code. Hence it will not cause similar issue with large strings.
| | * Bug#24388746: PRIVILEGE ESCALATION AND RACE CONDITION USING CREATE TABLEJon Olav Hauglid2016-08-192-6/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | During REPAIR TABLE of a MyISAM table, a temporary data file (.TMD) is created. When repair finishes, this file is renamed to the original .MYD file. The problem was that during this rename, we copied the stats from the old file to the new file with chmod/chown. If a user managed to replace the temporary file before chmod/chown was executed, it was possible to get an arbitrary file with the privileges of the mysql user. This patch fixes the problem by not copying stats from the old file to the new file. This is not needed as the new file was created with the correct stats. This fix only changes server behavior - external utilities such as myisamchk still does chmod/chown. No test case provided since the problem involves synchronization with file system operations.
| | * Bug #23296299 : HANDLE_FATAL_SIGNAL (SIG=11) INKailasnath Nagarkar2016-07-011-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | MY_TOSORT_UTF32 This patch is specific for mysql-5.5 ISSUE: When a charater that is larger than possible to handle is passed to function my_tosort_utf32(), it results in segmentation fault. In the scenario mentioned in the bug AES_ENCRYPT function is used which returns large value. This value is further passed to my_tosort_utf32 function. This causes to cross array bound for array uni_plane, resulting in segment violation. SOLUTION: This issue has got addressed in 5.6 onward releases through worklog 2673. The fix is similar backport of that. Check for maximum character before accessing the array uni_plane. In addition to function my_tosort_utf32, the same potential problem is also present in functions my_tolower_utf16, my_toupper_utf16, my_tosort_utf16, my_tolower_utf32, my_toupper_utf32, my_tosort_unicode, my_tolower_utf8mb4 and my_toupper_utf8mb4. Fixed these functions as well.
* | | compiler warningSergei Golubchik2017-03-161-2/+2
| | |
* | | MDEV-12261 build failure without P_SSergei Golubchik2017-03-152-2/+45
| | | | | | | | | | | | | | | restore mysql_file_delete_with_symlink() but let it use new my_handler_delete_with_symlink() mysys helper.
* | | Revert "Add extra HA_ERR message that Percona introduced within TokuDB ↵Vicențiu Ciorbaru2017-03-062-4/+2
| | | | | | | | | | | | | | | | | | 5.6.35-80" This reverts commit fa59ac5055686403ce8b61936069b04d4392b9d1.
* | | Add extra HA_ERR message that Percona introduced within TokuDB 5.6.35-80Vicențiu Ciorbaru2017-03-052-2/+4
| | |
* | | Merge branch '5.5' into 10.0Vicențiu Ciorbaru2017-03-033-45/+9
|\ \ \ | |/ /
| * | bugfix: remove my_delete_with_symlink()Sergei Golubchik2017-02-272-42/+0
| | | | | | | | | | | | | | | | | | it was race condition prone. instead use either a pair of my_delete() calls with already resolved paths, or a safe high-level function my_handler_delete_with_symlink(), like MyISAM and Aria already do.
| * | race-condition safe implementation of mi_delete_table/maria_delete_tableSergei Golubchik2017-02-271-0/+3
| | |
| * | MDEV-11902 mi_open race conditionSergei Golubchik2017-02-271-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | TOCTOU bug. The path is checked to be valid, symlinks are resolved. Then the resolved path is opened. Between the check and the open, there's a window when one can replace some path component with a symlink, bypassing validity checks. Fix: after we resolved all symlinks in the path, don't allow open() to resolve symlinks, there should be none. Compared to the old MyISAM/Aria code: * fastpath. Opening of not-symlinked files is just one open(), no fn_format() and lstat() anymore. * opening of symlinked tables doesn't do fn_format() and lstat() either. it also doesn't to realpath() (which was lstat-ing every path component), instead if opens every path component with O_PATH. * share->data_file_name stores realpath(path) not readlink(path). So, SHOW CREATE TABLE needs to do lstat/readlink() now (see ::info()), and certain error messages (cannot open file "XXX") show the real file path with all symlinks resolved.
| * | cleanup: mysys_test_invalid_symlinkSergei Golubchik2017-02-271-0/+2
| | | | | | | | | | | | | | | Remove maria_test_invalid_symlink() and myisam_test_invalid_symlink(), introduce mysys_test_invalid_symlink(). Other engines might need it too
| * | Fix for memory leak in applications, like QT,that callsMonty2017-01-271-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | my_thread_global_init() + my_thrad_global_end() repeatadily. This caused THR_KEY_mysys to be allocated multiple times. Deletion of THR_KEY_mysys was originally in my_thread_global_end() but was moved to my_end() as DBUG uses THR_KEY_mysys and DBUG is released after my_thread_global_end() is called. Releasing DBUG before my_thread_global_end() and move THR_KEY_mysys back into my_thread_global_end() could be a solution, but as safe_mutex and other things called by my_thread_global_end is using DBUG it may not be completely safe. To solve this, I used the simple solution to add a marker that THR_KEY_mysys is created and not re-create it in my_thread_global_init if it already exists.
* | | Windows : Fix server compile errors when compile with /Zc:strictStrings optionVladislav Vaintroub2017-02-281-4/+3
| | |
* | | Merge remote-tracking branch 'origin/5.5' into 10.0vicentiu2017-01-061-0/+4
|\ \ \ | |/ /
| * | move check_user/set_user from mysqld.cc to mysysSergei Golubchik2016-12-221-0/+4
| | |
* | | MDEV-11343 LOAD DATA INFILE fails to load data with an escape character ↵Alexander Barkov2016-11-291-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | followed by a multi-byte character Partially backporting MDEV-9874 from 10.2 to 10.0 READ_INFO::read_field() raised the ER_INVALID_CHARACTER_STRING error when reading an escape character followed by a multi-byte character. Raising wellformedness errors in READ_INFO::read_field() was wrong, because the main goal of READ_INFO::read_field() is to *unescape* the data which was presumably escaped using mysql_real_escape_string(), using the same character set with the one specified in "LOAD DATA INFILE ... CHARACTER SET ..." (or assumed by default). During LOAD DATA, multi-byte characters are not always scanned as a single entity! In case of escaped data, parts of a multi-byte character can be scanned on different loop iterations. So the old code erroneously tested welformedness in the middle of a multi-byte character. Moreover, the data after unescaping can go into a BLOB field, not a text field. Wellformedness tests are meaningless in this case. Ater this patch, wellformedness is only checked later, during Field::store(str,length,cs) time. The loop that scans bytes only makes sure to revert the changes made by mysql_real_escape_string(). Note, in some cases users can supply data which did not really go through mysql_real_escape_string() and was escaped by some other means, or was not escaped at all. The file reported in this MDEV contains the string "\ä", which is an example of such improperly escaped data, as - either there should be two backslashes: "\\ä" - or there should be no backslashes at all: "ä" mysql_real_escape_string() could not generate "\ä".
* | | MDEV-10951 Field_newdate::cmp access violationVladislav Vaintroub2016-10-252-18/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The crash is caused by macro uint3korr() accessing memory (1 byte) past the end of allocated page. The macro is written such it reads 4 bytes instead of 3 and discards the value of the last byte. However, it is not always guaranteed that all uint3korr accesses will be valid (i.e that the caller allocates an extra byte after the value). In particular, the tree in Item_func_group_concat does not account for any extra bytes that it would need for comparison of keys in some cases (Field_newdate::cmp, Field_medium::cmp) The fix change uint3korr so it does not access extra bytes.
* | | Merge branch '5.5' into 10.0Sergei Golubchik2016-09-272-4/+3
|\ \ \ | |/ /
| * | MDEV-10725 Server 10.1.17 fails to build using clang with c++11Sergei Golubchik2016-09-261-2/+1
| | | | | | | | | | | | | | | my_offsetof() returns a difference of two pointers, it must use the appropriate return type (my_ptrdiff_t, not size_t)
| * | don't use my_copystat in the serverSergei Golubchik2016-09-121-2/+2
| | | | | | | | | | | | | | | | | | | | | it was supposed to be used in command-line tools only. Different fix for 4e5473862e: Bug#24388746: PRIVILEGE ESCALATION AND RACE CONDITION USING CREATE TABLE
* | | Fixed "Packets out of order" warning message on stdout in clients,Monty2016-08-212-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | compiled for debugging, when the server goes down This happens in the following scenario: - Server gets a shutdown message - Servers sends error ER_CONNECTION_KILLED to the clients connection - The client sends a query to the server, before the server has time to close the connection to the client - Client reads the ER_CONNECTION_KILLED error message In the above case, the packet number for the reply is one less than what the client expected and the client prints "Packets out of order". Fixed the following way: - The client accepts now error packages with a packet number one less than expected. - To ensure that this issue can be detected early in my_real_read(), error messages sent to the client are not compressed, even when compressed protocol is used.
* | | [MDEV-9127] Crash reporter often fails to show the query that crashedVicențiu Ciorbaru2016-07-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | Addreses are not necessarily between heap_start && heap_end. Malloc calls using mmap can place pointers outside these bounds. In this case, we'll warn the user that the query pointer is potentially invalid. However, we'll attempt to print the data anyway after we're done printing everything else.
* | | Merge branch '5.5' into bb-10.0Sergei Golubchik2016-06-213-2/+9
|\ \ \ | |/ /
| * | Fixed compilation failure using clangVicențiu Ciorbaru2016-06-141-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | Both aria and myisam storage engines feature a logic path in thr_find_all_keys that leads to undefined behaviour by bypassing the initialization code of variables after my_thread_init(). By refactoring the nested logic into a separate function, this problem is resolved.
| * | MDEV-10166 probes_mysql_nodtrace.h is not provided anymore by mariadb-10.0.25Sergei Golubchik2016-06-141-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | backport of commit bba3d42 Author: Sergei Golubchik <serg@mariadb.org> Date: Sat Apr 30 10:27:42 2016 +0200 MDEV-9926 probes_mysql.h includes nonexisting files install private generated files
| * | Merge branch 'mysql/5.5' into 5.5Sergei Golubchik2016-06-141-1/+1
| |\ \ | | |/
| | * BUG#22594514: HANDLE_FATAL_SIGNAL (SIG=11) INNisha Gopalakrishnan2016-03-171-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | UNIQUE::~UNIQUE | SQL/UNIQUES.CC:355 Analysis ======== Enabling the sort_buffer_size with a large value can cause operations utilizing the sort buffer like DELETE as mentioned in the bug report to fail. 5.5 and 5.6 versions reports OOM error while in 5.7+, the server crashes. While initializing the mem_root for the sort buffer tree, the block size for the mem_root is determined from the 'sort_buffer_size' value. This unsigned long value is typecasted to unsigned int, hence it becomes zero. Further block_size computation while initializing the mem_root results in a very large block_size value. Hence while trying to allocate a block during the DELETE operation, an OOM error is reported. In case of 5.7+, the PFS instrumentation for memory allocation, overshoots the unsigned value and allocates a block of just one byte. While trying to free the block of the mem_root, the original block_size is used. This triggers the crash since the server tries to free unallocated memory. Fix: ==== In order to restrict usage of such unreasonable sort_buffer_size, the typecast of block size to 'unsigned int' is removed and hence reports OOM error across all versions for sizes exceeding unsigned int range.
| | * WL#9072: Backport WL#8785 to 5.5Ramil Kalimullin2016-02-193-5/+27
| | |
| * | MDEV-9366 : do_shutdown_server fails to detect server shutdown on Windows.Vladislav Vaintroub2016-06-081-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | Fix test whether process is alive in mysqltest. Also fix SHUT_RD definition on Windows to be SD_RECEIVE. SD_BOTH was used instead prior to this patch, and this would occasionally make mysql_shutdown() fail - when the socket for the current connection is not able send the COM_SHUTDOWN response anymore.
* | | Update AskMonty and Atlassian references to MariaDBiangilfillan2016-03-081-1/+1
| | |
* | | Fix spelling: occurred, execute, which etcOtto Kekäläinen2016-03-041-1/+1
| | |
View Lorry Controller Status