summaryrefslogtreecommitdiff
path: root/sql-common
Commit message (Collapse)AuthorAgeFilesLines
* Merge remote-tracking branch 'mysql/5.5' into 5.5Oleksandr Byelkin2018-07-291-0/+4
|\ | | | | | | | | | | | | | | | | | | We do not accept: 1. We did not have this problem (fixed earlier and better) d982e717aba67227ec40761a21a4211db91aa0e2 Bug#27510150: MYSQLDUMP FAILS FOR SPECIFIC --WHERE CLAUSES 2. We do not have such options (an DBUG_ASSERT put just in case) bbc2e37fe4e0ca3a7cfa1437a763dc43829e98e2 Bug#27759871: BACKRONYM ISSUE IS STILL IN MYSQL 5.7 3. Serg fixed it in other way in this release: e48d775c6f066add457fa8cfb2ebc4d5ff0c7613 Bug#27980823: HEAP OVERFLOW VULNERABILITIES IN MYSQL CLIENT LIBRARY
| * Bug#27980823: HEAP OVERFLOW VULNERABILITIES IN MYSQL CLIENT LIBRARYmysql-5.5.61Ivo Roylev2018-06-151-1/+3
| | | | | | | | (cherry picked from commit b5b986b2cbd9a7848dc3f48e5c42b6d4e1e5fb22)
| * Bug#27759871: BACKRONYM ISSUE IS STILL IN MYSQL 5.7Arun Kuruvila2018-05-141-0/+41
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Description:- Client applications establishes connection to server, which does not support SSL, via TCP even when SSL is enforced via MYSQL_OPT_SSL_MODE or MYSQL_OPT_SSL_ENFORCE or MYSQL_OPT_SSL_VERIFY_SERVER_CERT. Analysis:- There exist no error handling for catching client applications which enforces SSL connection to connect to a server which does not support SSL. Fix:- Error handling is done to catch above mentioned scenarios.
| * Bug#25471090: MYSQL USE AFTER FREEArun Kuruvila2018-02-122-9/+44
| | | | | | | | | | | | | | | | | | | | Description:- Mysql client crashes when trying to connect to a fake server which is sending incorrect packets. Analysis:- Mysql client crashes when it tries to read server version details. Fix:- A check is added in "red_one_row()".
| * Bug#26585560 - MYSQL DAEMON SHOULD CREATE ITS PID FILE ASShishir Jaiswal2017-12-021-0/+54
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ROOT DESCRIPTION =========== If the .pid file is created at a world-writable location, it can be compromised by replacing the server's pid with another running server's (or some other non-mysql process) PID causing abnormal behaviour. ANALYSIS ======== In such a case, user should be warned that .pid file is being created at a world-writable location. FIX === A new function is_file_or_dir_world_writable() is defined and it is called in create_pid_file() before .pid file creation. If the location is world-writable, a relevant warning is thrown. NOTE ==== 1. PID file is always created with permission bit 0664, so for outside world its read-only. 2. Ignoring the case when permission is denied to get the dir stats since the .pid file creation would fail anyway in such a case.
| * BUG#25575605: SETTING --SSL-MODE=REQUIRED SENDS CREDENTIALS BEFORE VERIFYING ↵Ramil Kalimullin2017-03-101-2/+52
| | | | | | | | | | | | | | SSL CONNECTION MYSQL_OPT_SSL_MODE option introduced. It is set in case of --ssl-mode=REQUIRED and permits only SSL connection.
| * (no commit message)Nisha Gopalakrishnan2017-02-161-4/+7
| |
* | MDEV-10246 ssl-* config file options have no effect without mysql_ssl_set()Vladislav Vaintroub2018-06-051-0/+4
| | | | | | | | | | | | | | | | Partially revert 4ef74979969ac9339d0d42c11a6f26632e6776f1 that caused regression. Any ssl- option must imply use_ssl=1, even if mysql_set_ssl() was not used.
* | protocol: verify that number of rows is correctSergei Golubchik2018-05-041-7/+15
| |
* | Use after free in authenticationSergei Golubchik2018-05-011-2/+2
| |
* | Bug#25471090: MYSQL USE AFTER FREESergei Golubchik2018-04-301-2/+2
| | | | | | | | a better fix
* | Bug#25471090: MYSQL USE AFTER FREESergei Golubchik2018-04-271-1/+1
| | | | | | | | | | | | fix another similar line followup for 7828ba0df488
* | Bug#25471090: MYSQL USE AFTER FREESergei Golubchik2018-04-191-1/+1
| | | | | | | | in a specially crafted invalid packet, one can get end_pos < pos here
* | don't disable SSL when connecting via libmysqldSergei Golubchik2018-04-031-2/+2
| |
* | MDEV-13459 Warnings, when compiling with gcc-7.xSergei Golubchik2017-10-171-0/+1
| | | | | | | | mostly caused by -Wimplicit-fallthrough
* | respect client's desire to force ssl even when WITH_SSL=NOSergei Golubchik2017-04-201-2/+2
| | | | | | | | | | of course, this combination can never succeed, we must fail to connect here.
* | MDEV-11933 Wrong usage of linked list in mysql_prune_stmt_listSergei Golubchik2017-02-271-9/+2
| | | | | | | | | | | | | | | | mysql_prune_stmt_list() was walking the list following element->next pointers, but inside the loop it was invoking list_add(element) that modified element->next. So, mysql_prune_stmt_list() failed to visit and reset all elements, and some of them were left with pointers to invalid MYSQL.
* | Merge branch 'mysql/5.5' into 5.5Sergei Golubchik2016-06-141-4/+18
|\ \ | |/
| * Bug#21920657: SSL-CA FAILS SILENTLY IF THE PATH CANNOT BEArun Kuruvila2016-03-011-4/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | FOUND Description:- Failure during the validation of CA certificate path which is provided as an option for 'ssl-ca' returns two different errors for YaSSL and OPENSSL. Analysis:- 'ssl-ca', option used for specifying the ssl ca certificate path. Failing to validate this certificate with OPENSSL returns an error, "ERROR 2026 (HY000): SSL connection error: SSL_CTX_set_default_verify_paths failed". While YASSL returns "ERROR 2026 (HY000): SSL connection error: ASN: bad other signature confirmation". Error returned by the OPENSSL is correct since "SSL_CTX_load_verify_locations()" returns 0 (in case of OPENSSL) for the failure and sets error as "SSL_INITERR_BAD_PATHS". In case of YASSL, "SSL_CTX_load_verify_locations()" returns an error number which is less than or equal to 0 in case of error. Error numbers for YASSL is mentioned in the file, 'extra/yassl/include/openssl/ssl.h'(line no : 292). Also 'ssl-ca' does not accept tilde home directory path substitution. Fix:- The condition which checks for the error in the "SSL_CTX_load_verify_locations()" is changed in order to accommodate YASSL as well. A logic is written in "mysql_ssl_set()" in order accept the tilde home directory path substitution for all ssl options.
* | Merge branch 'mysql/5.5' into 5.5Sergei Golubchik2016-02-091-32/+57
|\ \ | |/ | | | | | | reverted about half of commits as either not applicable or outright wrong
| * Bug #22295186: CERTIFICATE VALIDATION BUG IN MYSQL MAY ALLOW MITMYashwant Sahu2016-01-111-26/+64
| |
* | MDEV-9112: Non-blocking client API missing on non-x86 platformsGeorg Richter2016-02-011-0/+1
| | | | | | | | | | | | | | The check for UCONTEXT in cmake was somehow become broken, disabling the fallback to ucontext. This caused the non-blocking client API to not be available for non-x86 platforms, on which no hand-crafted assembler implementation of my_context is available.
* | MDEV-9212 ssl-validate-cert incorrect hostname checkSergei Golubchik2015-12-081-27/+28
| | | | | | | | | | | | | | Reimplement ssl_verify_server_cert() using the logic from https://wiki.openssl.org/index.php/Hostname_validation The bug was discovered by Alex Gaynor.
* | MDEV-7937: Enforce SSL when --ssl client option is usedVicențiu Ciorbaru2015-06-091-4/+19
| | | | | | | | | | | | Using --ssl-verify-server-cert and --ssl[-*] implies that the ssl connection is required. The mysql client will now print an error if ssl is required, but the server can not handle a ssl connection.
* | MDEV-7859 SSL hostname verification fails for long subject namesSergei Golubchik2015-04-271-2/+10
| | | | | | | | | | | | | | | | Don't use a fixed buffer for X509_NAME_oneline() in the client. Do as the server does - allocate it dynamically. For a test - regenerate certificates to have the server cert with a long subject.
* | Merge remote-tracking branch 'bzr/5.5' into bb-5.5-mergeSergei Golubchik2015-02-121-0/+5
|\ \
| * | MDEV-7435 Windows debug: Run-Time Check Failure #3 - The variable 'unused' ↵Alexey Botchkov2015-02-061-0/+5
| | | | | | | | | | | | | | | | | | | | | is being used without being initialized. Fixed as it's done in 10.0.
* | | Merge remote-tracking branch 'mysql/5.5' into bb-5.5-merge @ mysql-5.5.42Sergei Golubchik2015-02-111-2/+2
|\ \ \ | |/ / |/| / | |/
| * Bug#17599258:- ERROR 1160 (08S01): GOT AN ERROR WRITINGArun Kuruvila2014-11-101-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | COMMUNICATION PACKETS; FEDERATED TABLE Description:- Execution of FLUSH TABLES on a federated table which has been idle for wait_timeout (on the remote server) + tcp_keepalive_time, fails with an error, "ERROR 1160 (08S01): Got an error writing communication packets." Analysis:- During FLUSH TABLE execution the federated table is closed which will inturn close the federated connection. While closing the connection, federated server tries to communincate with the remote server. Since the connection was idle for wait_timeout(on the remote server)+ tcp_keepalive_time, the socket gets closed. So this communication fails because of broken pipe and the error is thrown. But federated connections are expected to reconnect silently. And also it cannot reconnect because the "auto_reconnect" variable is set to 0 in "mysql_close()". Fix:- Before closing the federated connection, in "ha_federated_close()", a check is added which will verify wheather the connection is alive or not. If the connection is not alive, then "mysql->net.error" is set to 2 which will indicate that the connetion is broken. Also the setting of "auto_reconnect" variable to 0 is delayed and is done after "COM_QUIT" command. NOTE:- For reproducing this issue, "tcp_keepalive_time" has to be set to a smaller value. This value is set in the "/proc/sys/net/ipv4/tcp_keepalive_time" file in Unix systems. So we need root permission for changing it, which can't be done through mtr test. So submitting the patch without mtr test.
| * Bug #18384260: MULTIPLE SECURITY ISSUES IN CERTIFICATE VALIDATIONGeorgi Kodinov2014-07-311-0/+6
| | | | | | | | | | the 5.5 version of the fix. Added a call to X509_verify_cert_error_string() into the client certificate verification code.
| * Bug #18053212 MYSQL_GET_SERVER_VERSION() CALL WITHOUT A VALID CONNECTION ↵Igor Solodovnikov2014-04-171-6/+16
| | | | | | | | | | | | RESULTS IN SEG FAULT When there is no connection mysql_get_server_version() will return 0 and report CR_COMMANDS_OUT_OF_SYNC error.
| * Updated/added copyright headersMurthy Narkedimilli2014-01-061-1/+2
| |
| * Bug #17297012 MEMORY LEAK IN MYSQL_OPTIONS WHILE CALLING WITH OPTION ↵Igor Solodovnikov2013-08-301-0/+1
| | | | | | | | | | | | | | | | MYSQL_SET_CLIENT_IP Memory Leak in mysql_options() was caused by missing call to my_free() in MYSQL_SET_CLIENT_IP branch. Fixed by adding my_free() to cleanup mysql->options.client_ip value before assigning new value.
| * Bug #16680313: CLIENT DOESN'T READ PLUGIN-DIR FROM MY.CNF SET BYGeorgi Kodinov2013-04-241-2/+2
| | | | | | | | | | | | | | MYSQL_READ_DEFAULT_FILE Parsing of the plugin-dir config file option was not working due to a typo. Fixed the typo. No test case can be added due to lack of support for defaults-exitra-file testing in mysql-test-run.pl. Thanks to Sinisa for contributing the fix.
| * Fix for Bug 16395495 - OLD FSF ADDRESS IN GPL HEADERMurthy Narkedimilli2013-03-192-2/+2
| |
| * Merge of patch for bug#14685362 from mysql-5.1.Nirbhay Choubey2013-03-181-0/+2
| |\
| | * Updated/added copyright headers.Murthy Narkedimilli2013-02-251-1/+1
| | |
| * | Bug #12910665: AUTH-PLUGIN-DATA-LEN NOT TESTED FOR VALIDITY BY THE Georgi Kodinov2012-06-291-0/+6
| | | | | | | | | | | | | | | CLIENT Added a check for a negative second part of the scramble length.
| * | fixed a missing breakGeorgi Kodinov2012-07-051-0/+1
| | |
| * | Bug #12998841: libmysql divulges plaintext password upon request in 5.5Georgi Kodinov2012-07-052-9/+65
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 1. Clear text password client plugin disabled by default. 2. Added an environment variable LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN, that when set to something starting with '1', 'Y' or 'y' will enable the clear text plugin for all connections. 3. Added a new mysql_options() option : MYSQL_ENABLE_CLEARTEXT_PLUGIN that takes an my_bool argument. When the value of the argument is non-zero the clear text plugin is enabled for this connection only. 4. Added an enable-cleartext-plugin config file option that takes a numeric argument. If the numeric value of the numeric argument is non-zero the clear text plugin is enabled for the connection 5. Added a boolean command line option "--enable_cleartext_plugin" to mysql, mysqlslap and mysqladmin. When specified it will call mysql_options with the effect of #3 6. Added a new CLEARTEXT option to the connect command in mysqltest. When specified it will enable the cleartext plugin for usage. 7. Added test cases and updated existing ones that need the clear text plugin.
| * | merge bug#13708485 5.1->5.5Georgi Kodinov2012-06-291-3/+12
| |\ \ | | |/
| | * Bug #13708485: malformed resultset packet crashes clientGeorgi Kodinov2012-06-281-3/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Several fixes : * sql-common/client.c Added a validity check of the fields metadata packet sent by the server. Now libmysql will check if the length of the data sent by the server matches what's expected by the protocol before using the data. * client/mysqltest.cc Fixed the error handling code in mysqltest to avoid sending new commands when the reading the result set failed (and there are unread data in the pipe). * sql_common.h + libmysql/libmysql.c + sql-common/client.c unpack_fields() now generates a proper error when it fails. Added a new argument to this function to support the error generation. * sql/protocol.cc Added a debug trigger to cause the server to send a NULL insted of the packet expected by the client for testing purposes.
| * | Updated/added copyright headersMySQL Build Team2012-02-161-1/+1
| |\ \ | | |/
| | * Updated/added copyright headersKent Boortz2012-02-151-1/+1
| | |\
| * | \ Merging BUG#13458237 from 5.1.Alexander Barkov2012-01-241-1/+1
| |\ \ \ | | |/ /
| | * | BUG#13458237 - INCONSISTENT HANDLING OF INVALIDE DATES WITH ZERO DAY. ↵Alexander Barkov2012-01-241-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | SIMILAR TO '2009-10-00' - Reverting the patch for Bug # 12584302 The patch will be reverted in 5.1 and 5.5. The patch will not be reverted in 5.6, the change will be properly documented in 5.6. - Backporting DBUG_ASSERT not to crash on '0000-01-00' (already fixed in mysql-trunk (5.6))
| | * | Updated/added copyright headersKent Boortz2011-07-031-1/+2
| | |\ \
| * | \ \ Updated/added copyright headersKent Boortz2011-06-304-7/+8
| |\ \ \ \ | | |/ / /
| | * | | Updated/added copyright headersKent Boortz2011-06-303-6/+13
| | |\ \ \ | | | | |/ | | | |/|
| | | * | Updated/added copyright headersKent Boortz2011-06-303-6/+8
| | | | |
View Lorry Controller Status