Skip to content

Conversation

@VarunNagaraju
Copy link
Contributor

https://perconadev.atlassian.net/browse/PS-10386

  • Fixes buffer overflow in uservar, username, hostname with broken UTF8.
  • Fixes a heap buffer overflow in the append_identifier() method.
  • Fixes a heap buffer overflow when using functions as a parameter to SOURCE_POS_WAIT/MASTER_POS_WAIT that return text results.
  • Fixes a heap-use-after-free at int my_mb_wc_utf8_prototype.
  • Fixes a missing string escape in mysqldump.
  • Fixes fprintf_string function present in mysqldump to pass the string quote to mysql_real_escape_string_quote
    as a parameter.
  • Fixes a memory leak reported by innodb.bug34574604 test.
  • Fixes a potential unexpected behaviour when the index_id is greater than or equal to 2^32 in a rollback operation.
  • Improves the accuracy of the COMMAND_CLASS tag in audit log.
  • Fixes some compiler warnings and adds ability to compile with gcc-14 and clang-19.
  • Fixes some MTR tests.
  • Some packaging related fixes.

percona-ysorokin and others added 23 commits May 8, 2025 18:53
This reverts commit 0cb832f.

Reverted 'storage/myisam/ha_myisam.cc' part of the PS-8524.
https://perconadev.atlassian.net/browse/PS-9749

Bug#27618273 mysql/mysql-server@2109aa7ec3a

The function check_column_name() is used multiple places to verify
user input. In order to do a proper job it needs the length of the
input string, rather than just a pointer to the first character.

Also fix documentation for the validate_string() function.

This is a manual backport of
   commit e12a5db2626bc9104f5536f1876d399e14f847f5

For check_column_name() we backport only the range check when calling
my_ismbchar(). In newer branches we also did a validate_string(),
but that introduced other/unwanted changes to some test results.

Extend suppressions in lsan.supp to work with newer perl versions.

Add CTORS taking a LEX_CSTRING for classes Simple_cstring and Name_string.
These are taken from
   commit 46fe1cb52d168bd76bcce11cdb69a6e4ab647f4b
       Bug#28787272: FIX -WCAST-QUAL COMPILATION WARNINGS [noclose]

Change-Id: I70bace14e55c701aec602b058e6ba42c18514cc7
https://perconadev.atlassian.net/browse/PS-9749

Bug#22958632 mysql/mysql-server@5f3490aea8c

The function append_identifier() might receive bad input, e.g. strings
that are not valid according to the given charset/collation. Ensure
that it simply quotes the input, and never reads past-the-end of it.

Test case added.
…get_mi

https://perconadev.atlassian.net/browse/PS-9749

BUG#36421684 mysql/mysql-server@7c4223a632a

When using JSON fuctions as a parameter to a
SOURCE_POS_WAIT/MASTER_POS_WAIT, something that should also apply to
other functions that return text results, the string extracted from
the parameter did not have a safe pointer to it.

The cause is that the length of the string was not properly marked
inside its allocated space.

Usage of the method c_ptr_safe fixes this issue.

Change-Id: Ic2c54999293aa2e0833594754ad681d7453e03a1
https://perconadev.atlassian.net/browse/PS-9749

Bug#36593253 mysql/mysql-server@0491d9b4d93

Constant item objects need to support several val_str() calls,
which means we cannot use string buffers owned by bg_resbuf_mgr
(it will free results from previous calls on re-invokation of val_str()).

For Item_func_convex_hull the interaction between val_str(),
bg_convex_hull() and post_fix_result() is too complex for a similar
simple fix. Instead we introduce 'tmp_value' String in Item_func_centroid
and use this to hold a (shallow) copy of the result.
https://perconadev.atlassian.net/browse/PS-9749

Bug#37540722 mysql/mysql-server@2fafb0f1573

Added a missing string escaping in constructing one of the dump commands
to the server.
Fixed warnings in using enums.

Test case added.
https://perconadev.atlassian.net/browse/PS-9749

Bug#37607195 mysql/mysql-server@8afeb980783

The fprintf_string function present in mysqldump takes the quote
of the string as a parameter, but does not pass it to the
mysql_real_escape_string_quote to escape the string.

The fix is to pass the string quote to mysql_real_escape_string_quote
as a parameter.

Added a test case.

Change-Id: Idc2001a96679fe32bb48e5e3a14d724d5ab9cb9f
https://perconadev.atlassian.net/browse/PS-9749

Bug#37403052 mysql/mysql-server@df130daa135

Symptom:

ASAN reported memory leak in innodb.bug34574604 test.

Analysis:

A btr_pcur_t struct ("persistent cursor") has a field `m_old_rec_buf`
which, if not null, owns a buffer, in which old value of the record
is stored (this is what makes the cursor persistent, so that it know
what to find the right spot next time you use it).

This struct is often allocated using C-style idioms like malloc() and
free(), copied around via memcpy, or allocated with mem_heap_t along
with other objects, and then freed in one big go.
This in turn means this class can not really have a C++-style
destructor, as we can't even ensure it would be executed.
This in turn means that the duty to free the buffer pointed
`m_old_rec_buf` when btr_pcur_t is no longer needed is a burden
shared by developers who wrote code to instantiate the struct, use
the struct or are about to free it somehow - i.e. easy to get wrong.

One way to free this buffer explicitly is to invoke btr_pcur_close().

Also, calling btr_pcur_close() is an expected thing to do, if you ever
called btr_pcur_open() or btr_pcur_open_at_index_side().
(Perhaps also btr_pcur_open_on_user_rec() or btr_pcur_open_with_no_init()).

Some of the places missed to call btr_pcur_close() even though they
called btr_pcur_open().
One of them is row_log_table_apply_update(), which leads to a memory
leak reported by ASAN.

There were other places found by code inspection.

Solution:

This patch adds missing calls to btr_pcur_close() in the places identified
by above analysis.

Change-Id: I3207c70c838b5b079fad45b55debbbd6b790c26e
…r than max uint32

https://perconadev.atlassian.net/browse/PS-9749

Bug#36993445
mysql/mysql-server@e00328b4d06
mysql/mysql-server@808f6bfc22d

SYMPTOM:
When performing an insert operation on a table with a virtual index,
re-inserting the same row after rolling back the previous insert causes
unexpected behaviour failure if the index_id is greater than or equal to 2^32.

ROOT CAUSE:
The function used to log and read the index_id for virtual indexes in
the undo record does not support 64-bit integers, causing issues when
the index_id exceeds the maximum value of a 32-bit unsigned integer.

FIX:
Replace the existing logging and reading functions with
mach_u64_write_much_compressed() and mach_read_next_much_compressed(),
which support 64-bit integers.

Change-Id: I4831a3c979a4a797185e37318999af83132d58d5
https://perconadev.atlassian.net/browse/PS-9749

Bug#37227215 mysql/mysql-server@002349f6cb7

Problem
================================
When running valgrind, some tests are reporting:
realloc() with size 0
at 0x73B6B77: realloc (vg_replace_malloc.c:1690)
by 0x2B4AA7D8: realloc_node_set(node_set*, unsigned int)
   (node_set.c:82)

Analysis and Fix
================================
On old C Specifications, a Realloc with size 0 meant a free.
Nowadays, in modern C, a Realloc with size 0 has undefined
behavior, which is compiler-dependent.

To solve this, we modify the code in realloc_node_set to
verify if the size to realloc ends up being zero. If this
is the case, then we preserve the old pointer instead of
doing a realloc. With this change, we guarantee that we
won't have any memory leaks because the list will eventually
go through free_node_set, which blindly X_FREE a non-null
pointer and sets the size of the list to 0.

Change-Id: Id14fe1e0617f8c713792eefbc27ee91effa1dc40
https://perconadev.atlassian.net/browse/PS-9749

Bug#36686351 mysql/mysql-server@e3c9955d236

Problem: When a prepared statement is executed the COMMAND_CLASS
         tag in the audit log file is empty for the NAME tag
         Execute.

Fix: When a prepared statement is executed the COMMAND_CLASS
     should be populate with the sql_command of the query been
     executed.

Change-Id: I38d7c5ee51cc0ddcce0119292f7570227a804b5f
https://perconadev.atlassian.net/browse/PS-9749

Bug#36480358 mysql/mysql-server@bcc175a1381

Fix Wtemplate-id-cdtor warnings reported when MySQL 5.7
codebase is built with -std=c++20.

From: Bug #33574176 Compile MySQL with GCC 12
 - storage/myisam/ha_myisam.cc:1275:25: error:
   using a dangling pointer to 'buf' [-Werror=dangling-pointer=]

Change-Id: Id49242553ae4124f17baa716ee95268bc76e9f2d
https://perconadev.atlassian.net/browse/PS-9749

Raised MYSQL_VERSION_EXTRA to 54 in MYSQL_VERSION file.
Raised PERCONA_INNODB_VERSION to 54 in univ.i file.
https://perconadev.atlassian.net/browse/PS-9749

The following warnings suppressed in TokuDB code:
/home/yura/ws/percona-server-private/storage/tokudb/PerconaFT/portability/toku_assert.cc:125:12: error: variable length arrays in C++ are a Clang extension [-Werror,-Wvla-cxx-extension]
  125 |         char buff[buffsize];
      |                   ^~~~~~~~
/storage/tokudb/PerconaFT/portability/toku_assert.cc:125:12: note: read of non-const variable 'buffsize' is not allowed in a constant expression
/storage/tokudb/PerconaFT/portability/toku_assert.cc:124:6: note: declared here
  124 |         int buffsize = engine_status_num_rows * 128;  // assume 128 characters per row (gross overestimate, should be safe)

/home/yura/ws/percona-server-private/storage/tokudb/PerconaFT/src/ydb_cursor.cc:248:60: error: missing field 'ulen' initializer [-Werror,-Wmissing-designated-field-initializers]
  248 |     DBT found_key = { .data = (void *) key, .size = keylen };
      |                                                            ^

The following issue with 'strlcat()' redefinition fixed the same way as in 8.0
branch (with 'HAVE_STRLCAT' conditional define):
/home/yura/ws/percona-server-private/mysys_ssl/crypt_genhash_impl.cc:70:1: error: redefinition of a 'extern inline' function 'strlcat' is not supported in C++
   70 | strlcat(char *dst, const char *src, size_t siz)
      | ^
/usr/include/x86_64-linux-gnu/bits/string_fortified.h:167:8: note: previous definition is here
  167 | __NTH (strlcat (char *__restrict __dest, const char *__restrict __src,
      |        ^
https://perconadev.atlassian.net/browse/PS-9749

Added 'include/not_asan.inc' to the 'main.percona_processlist_tid' MTR
test case as it has issues under Address Sanitizer and hangs forever.
Similar change already done in 8.0 branch.
…r ASan

https://perconadev.atlassian.net/browse/PS-9749

Changed 'include/send_kill_to_mysqld.inc' to 'include/kill_mysqld.inc' in
the 'rocksdb.track_and_verify_wals_in_manifest' MTR test case because the
former used to hang forever under Address Sanitizer. Similar change already
done in 8.0 branch.
PKG-555 Packaging tasks for release - PS 5.7.44-54
PKG-555 Packaging tasks for release - PS 5.7.44-54 (post-EOL 6)
PKG-555 Packaging tasks for release - PS 5.7.44-54 (post-EOL 6)
Percona Server release 5.7.44-54
Copy link
Collaborator

@percona-ysorokin percona-ysorokin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@inikep inikep merged commit d7ee10e into percona:5.7 Jan 9, 2026
18 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants