Merge remote-tracking branch 'origin/3.1' into 3.3

# Conflicts: # include/ma_crypt.h # libmariadb/mariadb_lib.c
2025-08-08 14:02:17 +03:00 · 2023-09-21 23:45:35 +02:00
parent 9a0ddd87d3 1b3cf6b441
commit 463a50e973
13 changed files with 129 additions and 106 deletions
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -133,7 +133,7 @@ SET(CMAKE_CXX_FLAGS_RELWITHDEBINFO "${CMAKE_CXX_FLAGS_RELWITHDEBINFO} -DDBUG_OFF

 IF(CMAKE_COMPILER_IS_GNUCC)
  INCLUDE(CheckCCompilerFlag)
-  SET(GCC_FLAGS -Wunused -Wlogical-op -Wno-uninitialized  -Wall -Wextra -Wformat-security -Wno-init-self -Wwrite-strings -Wshift-count-overflow -Wdeclaration-after-statement -Wno-undef -Wno-unknown-pragmas)
+  SET(GCC_FLAGS -Wunused -Wlogical-op -Wno-uninitialized  -Wall -Wextra -Wformat-security -Wno-init-self -Wwrite-strings -Wshift-count-overflow -Wdeclaration-after-statement -Wno-undef -Wno-unknown-pragmas -Wno-stringop-truncation)
  FOREACH(GCC_FLAG ${GCC_FLAGS})
    CHECK_C_COMPILER_FLAG("${GCC_FLAG}" HAS_${GCC_FLAG}_FLAG)
    IF(${HAS_${GCC_FLAG}_FLAG})
--- a/cmake/WindowsCache.cmake
+++ b/cmake/WindowsCache.cmake
@@ -300,8 +300,7 @@ IF(MSVC_VERSION GREATER 1310)
 SET(HAVE_VSNPRINTF 1 CACHE  INTERNAL "")
 ENDIF()
 SET(HAVE_WEAK_SYMBOL CACHE  INTERNAL "")
-SET(HAVE_WORDS_BIGENDIAN TRUE CACHE  INTERNAL "")
-SET(WORDS_BIGENDIAN CACHE  INTERNAL "")
+SET(HAVE_BIGENDIAN CACHE  INTERNAL "")
 SET(HAVE__S_IFIFO 1 CACHE  INTERNAL "")
 SET(HAVE__S_IREAD 1 CACHE  INTERNAL "")
 SET(HAVE__finite 1 CACHE  INTERNAL "")
--- a/include/ma_crypt.h
+++ b/include/ma_crypt.h
@@ -31,6 +31,7 @@
 #define MA_HASH_SHA384    5
 #define MA_HASH_SHA512    6
 #define MA_HASH_RIPEMD160 7
+#define MA_HASH_MAX       8

 /*! Hash digest sizes */
 #define MA_MD5_HASH_SIZE 16
@@ -45,15 +46,7 @@
 /** \typedef MRL hash context */

 #if defined(HAVE_WINCRYPT)
-#include <windows.h>
-#include <bcrypt.h>
-typedef struct {
-  char free_me;
-  BCRYPT_ALG_HANDLE hAlg;
-  BCRYPT_HASH_HANDLE hHash;
-  PBYTE hashObject;
-  DWORD digest_len;
-} MA_HASH_CTX;
+typedef void MA_HASH_CTX;
 #elif defined(HAVE_OPENSSL)
 #include <openssl/evp.h>
 typedef EVP_MD_CTX MA_HASH_CTX;
@@ -68,11 +61,10 @@ typedef struct {
  @brief acquire and initialize new hash context

  @param[in] algorithm   hash algorithm
-  @param[in] ctx         pointer to a crypto context

  @return    hash context on success, NULL on error
 */
-MA_HASH_CTX *ma_hash_new(unsigned int algorithm, MA_HASH_CTX *ctx);
+MA_HASH_CTX *ma_hash_new(unsigned int algorithm);

 /**
  @brief release and deinitializes a hash context
@@ -154,11 +146,7 @@ static inline void ma_hash(unsigned int algorithm,
                           unsigned char *digest)
 {
  MA_HASH_CTX *ctx= NULL;
-#ifdef HAVE_WINCRYPT
-  MA_HASH_CTX dctx;
-  ctx= &dctx;
-#endif
-  ctx= ma_hash_new(algorithm, ctx);
+  ctx= ma_hash_new(algorithm);
  ma_hash_input(ctx, buffer, buffer_length);
  ma_hash_result(ctx, digest);
  ma_hash_free(ctx);
--- a/include/ma_global.h
+++ b/include/ma_global.h
@@ -964,7 +964,7 @@ do { doubleget_union _tmp; \

 #define float8get(V,M)   doubleget((V),(M))
 #define float8store(V,M) doublestore((V),(M))
-#endif /* WORDS_BIGENDIAN */
+#endif /* HAVE_BIGENDIAN */

 #endif /* __i386__ OR _WIN32 */

@@ -1034,7 +1034,7 @@ do { doubleget_union _tmp; \
 #define longlongget(V,M) memcpy(&V, (M), sizeof(ulonglong))
 #define longlongstore(T,V) memcpy((T), &V, sizeof(ulonglong))

-#endif /* WORDS_BIGENDIAN */
+#endif /* HAVE_BIGENDIAN */

 #ifndef THREAD
 #define thread_safe_increment(V,L) ((V)++)
--- a/libmariadb/ma_alloc.c
+++ b/libmariadb/ma_alloc.c
@@ -21,13 +21,14 @@
 #include <ma_sys.h>
 #include <ma_string.h>

+#define INIT_BLOCK_NUM 4
 void ma_init_alloc_root(MA_MEM_ROOT *mem_root, size_t block_size, size_t pre_alloc_size)
 {
  mem_root->free= mem_root->used= mem_root->pre_alloc= 0;
  mem_root->min_malloc=32;
  mem_root->block_size= (block_size-MALLOC_OVERHEAD-sizeof(MA_USED_MEM)+8);
  mem_root->error_handler=0;
-  mem_root->block_num= 4;
+  mem_root->block_num= INIT_BLOCK_NUM;
  mem_root->first_block_usage= 0;
 #if !(defined(HAVE_purify) && defined(EXTRA_DEBUG))
  if (pre_alloc_size)
@@ -141,6 +142,8 @@ void ma_free_root(MA_MEM_ROOT *root, myf MyFlags)
    root->free->left=root->pre_alloc->size-ALIGN_SIZE(sizeof(MA_USED_MEM));
    root->free->next=0;
  }
+  root->block_num= INIT_BLOCK_NUM;
+  root->first_block_usage= 0;
 }


--- a/libmariadb/ma_dtoa.c
+++ b/libmariadb/ma_dtoa.c
@@ -512,7 +512,7 @@ typedef uint64 ULLong;

 typedef union { double d; ULong L[2]; } U;

-#if defined(HAVE_BIGENDIAN) || defined(WORDS_BIGENDIAN) || \
+#if defined(HAVE_BIGENDIAN) || \
   (defined(__FLOAT_WORD_ORDER) && (__FLOAT_WORD_ORDER == __BIG_ENDIAN))
 #define word0(x) ((x)->L[0])
 #define word1(x) ((x)->L[1])
--- a/libmariadb/mariadb_lib.c
+++ b/libmariadb/mariadb_lib.c
@@ -123,7 +123,7 @@ extern int mthd_stmt_fetch_to_bind(MYSQL_STMT *stmt, unsigned char *row);
 extern int mthd_stmt_read_all_rows(MYSQL_STMT *stmt);
 extern void mthd_stmt_flush_unbuffered(MYSQL_STMT *stmt);
 extern my_bool _mariadb_read_options(MYSQL *mysql, const char *dir, const char *config_file, const char *group, unsigned int recursion);
-extern unsigned char *mysql_net_store_length(unsigned char *packet, size_t length);
+extern unsigned char *mysql_net_store_length(unsigned char *packet, ulonglong length);

 extern void
 my_context_install_suspend_resume_hook(struct mysql_async_context *b,
--- a/libmariadb/mariadb_stmt.c
+++ b/libmariadb/mariadb_stmt.c
@@ -492,7 +492,7 @@ MYSQL_RES *_mysql_stmt_use_result(MYSQL_STMT *stmt)
  return(NULL);
 }

-unsigned char *mysql_net_store_length(unsigned char *packet, size_t length)
+unsigned char *mysql_net_store_length(unsigned char *packet, ulonglong length)
 {
  if (length < (unsigned long long) L64(251)) {
    *packet = (unsigned char) length;
--- a/libmariadb/secure/gnutls_crypt.c
+++ b/libmariadb/secure/gnutls_crypt.c
@@ -41,7 +41,7 @@ static gnutls_digest_algorithm_t ma_hash_get_algorithm(unsigned int alg)
  }
 }

-MA_HASH_CTX *ma_hash_new(unsigned int algorithm, MA_HASH_CTX *unused_ctx __attribute__((unused)))
+MA_HASH_CTX *ma_hash_new(unsigned int algorithm)
 {
  gnutls_hash_hd_t ctx= NULL;
  gnutls_digest_algorithm_t hash_alg= ma_hash_get_algorithm(algorithm);
--- a/libmariadb/secure/openssl_crypt.c
+++ b/libmariadb/secure/openssl_crypt.c
@@ -43,7 +43,7 @@ static const EVP_MD *ma_hash_get_algorithm(unsigned int alg)
  }
 }

-MA_HASH_CTX *ma_hash_new(unsigned int algorithm, MA_HASH_CTX *unused __attribute__((unused)))
+MA_HASH_CTX *ma_hash_new(unsigned int algorithm)
 {
  EVP_MD_CTX *ctx= NULL;
  const EVP_MD *evp_md= ma_hash_get_algorithm(algorithm);
--- a/libmariadb/secure/win_crypt.c
+++ b/libmariadb/secure/win_crypt.c
@@ -20,84 +20,143 @@
 #include <bcrypt.h>
 #include <ma_crypt.h>
 #include <malloc.h>
+#include <stdlib.h>
+#include <stdio.h>

-BCRYPT_ALG_HANDLE Sha256Prov= 0;
-BCRYPT_ALG_HANDLE Sha512Prov= 0;
-BCRYPT_ALG_HANDLE RsaProv= 0;
-
-static LPCWSTR ma_hash_get_algorithm(unsigned int alg, BCRYPT_ALG_HANDLE *algHdl)
+/*
+  Error handling for bcrypt.
+  If we can't meaningfully return an error, dump error on stderr
+  and abort. Those errors are mostly likely programming errors
+  (invalid parameters and such)
+*/
+static inline void check_nt_status(int ret, const char *function,
+                                   const char *file, int line)
 {
-  switch(alg)
+  if (ret)
  {
+    fprintf(stderr,"invalid return %d from bcrypt, "
+        "function %s with file %s, line %d\n",
+        ret, function, file, line);
+    abort();
+  }
+}
+#define CHECK_NT_STATUS(ret) check_nt_status(ret, __func__, __FILE__, __LINE__)
+
+/*
+  Return Bcrypt algorithm ID (wchar string) for MariaDB numeric ID
+*/
+static LPCWSTR ma_hash_get_algorithm(unsigned int alg)
+{
+  switch (alg)
+  {
+  case MA_HASH_SHA1:
+    return BCRYPT_SHA1_ALGORITHM;
  case MA_HASH_SHA256:
-    *algHdl= Sha256Prov;
    return BCRYPT_SHA256_ALGORITHM;
+  case MA_HASH_SHA384:
+    return BCRYPT_SHA384_ALGORITHM;
  case MA_HASH_SHA512:
-    *algHdl= Sha512Prov;
    return BCRYPT_SHA512_ALGORITHM;
  default:
-    *algHdl= 0;
    return NULL;
  }
 }

-MA_HASH_CTX *ma_hash_new(unsigned int algorithm, MA_HASH_CTX *ctx)
+/* Cached algorithm provides handles. */
+static BCRYPT_ALG_HANDLE cached_alg_handles[MA_HASH_MAX];
+
+/*
+  Cleanup cached algorithm handles. It runs either on process exit,
+  or when DLL is unloaded (see _onexit() documentation)
+*/
+static int win_crypt_onexit(void)
 {
-  MA_HASH_CTX *newctx= ctx;
-  DWORD cbObjSize, cbData;
-  LPCWSTR alg;
-  BCRYPT_ALG_HANDLE algHdl= 0;
-
-  alg= ma_hash_get_algorithm(algorithm, &algHdl);
-
-  if (!alg || !algHdl)
-    return NULL;
-
-  if (BCryptGetProperty(algHdl, BCRYPT_OBJECT_LENGTH,
-                      (PBYTE)&cbObjSize, sizeof(DWORD),
-                      &cbData, 0) < 0)
-      goto error;
-
-  if (!newctx)
+  int i;
+  for (i= 0; i < MA_HASH_MAX; i++)
  {
-    newctx= (MA_HASH_CTX *)calloc(1, sizeof(MA_HASH_CTX));
-    newctx->free_me= 1;
+    if (cached_alg_handles[i])
+      BCryptCloseAlgorithmProvider(cached_alg_handles[i], 0);
  }
-  else
-    memset(newctx, 0, sizeof(MA_HASH_CTX));
+  return 0;
+}

-  newctx->hashObject= (PBYTE)malloc(cbObjSize);
-  newctx->digest_len= (DWORD)ma_hash_digest_size(algorithm);
-  BCryptCreateHash(algHdl, &newctx->hHash, newctx->hashObject, cbObjSize, NULL, 0, 0);
+static void register_cleanup_onexit_once()
+{
+  static LONG onexit_called;
+  if (!InterlockedCompareExchange(&onexit_called, 1, 0))
+    _onexit(win_crypt_onexit);
+}

-  return newctx;
-error:
-  if (newctx && !ctx)
-    free(newctx);
+/*
+  Given algorithm ID, return BCRYPT provider handle.
+  Uses or populates algorithm provider handle cache.
+*/
+static BCRYPT_ALG_HANDLE ma_hash_get_algorithm_handle(unsigned int alg)
+{
+  static SRWLOCK lock= SRWLOCK_INIT;
+  BCRYPT_ALG_HANDLE handle= NULL;
+  const wchar_t *name;
+
+  if ((handle= cached_alg_handles[alg]) != NULL)
+    return handle;
+
+  name= ma_hash_get_algorithm(alg);
+  if (!name)
    return NULL;
+
+  AcquireSRWLockExclusive(&lock);
+  if ((handle= cached_alg_handles[alg]) == NULL)
+  {
+    if (BCryptOpenAlgorithmProvider(&handle, name, NULL, 0) == 0)
+      cached_alg_handles[alg]= handle;
+    else
+      handle= NULL;
+  }
+  ReleaseSRWLockExclusive(&lock);
+
+  if (handle)
+    register_cleanup_onexit_once();
+  return handle;
+}
+
+MA_HASH_CTX *ma_hash_new(unsigned int algorithm)
+{
+  BCRYPT_HASH_HANDLE hash_handle;
+  BCRYPT_ALG_HANDLE alg_handle= ma_hash_get_algorithm_handle(algorithm);
+
+  if (!alg_handle)
+    return NULL;
+
+  if (BCryptCreateHash(alg_handle, &hash_handle, NULL, 0, NULL, 0, 0))
+    return NULL;
+
+  return hash_handle;
 }

 void ma_hash_free(MA_HASH_CTX *ctx)
 {
-  if (ctx)
-  {
-    if (ctx->hHash)
-      BCryptDestroyHash(ctx->hHash);
-    if (ctx->hashObject)
-      free(ctx->hashObject);
-	if (ctx->free_me)
-      free(ctx);
-  }
+  NTSTATUS status;
+  if (!ctx)
+    return;
+  status= BCryptDestroyHash(ctx);
+  CHECK_NT_STATUS(status);
 }

-void ma_hash_input(MA_HASH_CTX *ctx,
-                   const unsigned char *buffer,
-                   size_t len)
+void ma_hash_input(MA_HASH_CTX *ctx, const unsigned char *buffer, size_t len)
 {
-  BCryptHashData(ctx->hHash, (PUCHAR)buffer, (LONG)len, 0);
+  NTSTATUS status= BCryptHashData(ctx, (PUCHAR) buffer, (ULONG) len, 0);
+  CHECK_NT_STATUS(status);
 }

 void ma_hash_result(MA_HASH_CTX *ctx, unsigned char *digest)
 {
-  BCryptFinishHash(ctx->hHash, digest, ctx->digest_len, 0);
+  DWORD hash_length;
+  DWORD data_length;
+  NTSTATUS status=
+      BCryptGetProperty(ctx, BCRYPT_HASH_LENGTH, (PBYTE) &hash_length,
+                        sizeof(DWORD), &data_length, 0);
+  CHECK_NT_STATUS(status);
+
+  status= BCryptFinishHash(ctx, digest, (ULONG) hash_length, 0);
+  CHECK_NT_STATUS(status);
 }
--- a/plugins/auth/caching_sha2_pw.c
+++ b/plugins/auth/caching_sha2_pw.c
@@ -52,8 +52,6 @@
 #include <wincrypt.h>
 #include <bcrypt.h>

-extern BCRYPT_ALG_HANDLE RsaProv;
-extern BCRYPT_ALG_HANDLE Sha256Prov;
 #endif

 #include <ma_crypt.h>
@@ -84,12 +82,8 @@ static int ma_sha256_scramble(unsigned char *scramble, size_t scramble_len,
  unsigned char digest1[MA_SHA256_HASH_SIZE],
                digest2[MA_SHA256_HASH_SIZE],
                new_scramble[MA_SHA256_HASH_SIZE];
-#ifdef HAVE_WINCRYPT
-  MA_HASH_CTX myctx;
-  MA_HASH_CTX *ctx= &myctx;
-#else
+
  MA_HASH_CTX *ctx = NULL;
-#endif
  size_t i;

  /* check if all specified lengths are valid */
@@ -97,27 +91,22 @@ static int ma_sha256_scramble(unsigned char *scramble, size_t scramble_len,
    return 1;

  /* Step1: create sha256 from source */
-  if (!(ctx= ma_hash_new(MA_HASH_SHA256, ctx)))
+  if (!(ctx= ma_hash_new(MA_HASH_SHA256)))
    return 1;
  ma_hash_input(ctx, source, source_len);
  ma_hash_result(ctx, digest1);
  ma_hash_free(ctx);
-#ifndef HAVE_WINCRYPT
-  ctx = NULL;
-#endif
+

  /* Step2: create sha256 digest from digest1 */
-  if (!(ctx= ma_hash_new(MA_HASH_SHA256, ctx)))
+  if (!(ctx= ma_hash_new(MA_HASH_SHA256)))
    return 1;
  ma_hash_input(ctx, digest1, MA_SHA256_HASH_SIZE);
  ma_hash_result(ctx, digest2);
  ma_hash_free(ctx);
-#ifndef HAVE_WINCRYPT
-  ctx = NULL;
-#endif

  /* Step3: create sha256 digest from digest2 + salt */
-  if (!(ctx= ma_hash_new(MA_HASH_SHA256, ctx)))
+  if (!(ctx= ma_hash_new(MA_HASH_SHA256)))
    return 1;
  ma_hash_input(ctx, digest2, MA_SHA256_HASH_SIZE);
  ma_hash_input(ctx, salt, salt_len);
@@ -460,10 +449,6 @@ static int auth_caching_sha2_init(char *unused1 __attribute__((unused)),
    int unused3     __attribute__((unused)),
    va_list unused4 __attribute__((unused)))
 {
-#if defined(HAVE_WINCRYPT)
-  BCryptOpenAlgorithmProvider(&Sha256Prov, BCRYPT_SHA256_ALGORITHM, NULL, 0);
-  BCryptOpenAlgorithmProvider(&RsaProv, BCRYPT_RSA_ALGORITHM, NULL, 0);
-#endif
  return 0;
 }
 /* }}} */
@@ -471,10 +456,6 @@ static int auth_caching_sha2_init(char *unused1 __attribute__((unused)),
 /* {{{ auth_caching_sha2_deinit */
 static int auth_caching_sha2_deinit(void)
 {
-#if defined(HAVE_WINCRYPT)
-  BCryptCloseAlgorithmProvider(Sha256Prov, 0);
-  BCryptCloseAlgorithmProvider(RsaProv, 0);
-#endif
  return 0;
 }
 /* }}} */
--- a/plugins/auth/ed25519.c
+++ b/plugins/auth/ed25519.c
@@ -45,7 +45,6 @@
 #include <windows.h>
 #include <wincrypt.h>
 #include <bcrypt.h>
-extern BCRYPT_ALG_HANDLE Sha512Prov;
 #elif defined(HAVE_OPENSSL)
 #include <openssl/rsa.h>
 #include <openssl/pem.h>
@@ -123,9 +122,6 @@ static int auth_ed25519_init(char *unused1 __attribute__((unused)),
    int unused3     __attribute__((unused)),
    va_list unused4 __attribute__((unused)))
 {
-#if defined(HAVE_WINCRYPT)
-  BCryptOpenAlgorithmProvider(&Sha512Prov, BCRYPT_SHA512_ALGORITHM, NULL, 0);
-#endif
  return 0;
 }
 /* }}} */
@@ -133,9 +129,6 @@ static int auth_ed25519_init(char *unused1 __attribute__((unused)),
 /* {{{ auth_ed25519_deinit */
 static int auth_ed25519_deinit(void)
 {
-#if defined(HAVE_WINCRYPT)
-  BCryptCloseAlgorithmProvider(Sha512Prov, 0);
-#endif
  return 0;
 }
 /* }}} */