Old style C functions `strcpy()`, `strcat()` and `sprintf()` are vulnerable to
security issues due to lacking memory boundary checks. Replace these in the
Connect storage engine with safe new and/or custom functions such as
`snprintf()` `safe_strcpy()` and `safe_strcat()`.
With this change FlawFinder and other static security analyzers report 287
fewer findings.
All new code of the whole pull request, including one or several files that are
either new files or modified ones, are contributed under the BSD-new license. I
am contributing on behalf of my employer Amazon Web Services, Inc.
- Bug happens only in case when the range function on empty key single
column index (XINDEXS) is used.
- Solution is to return with empty result in this scenario.
Reviewed by: <>
This commit replaces sprintf(buf, ...) with
snprintf(buf, sizeof(buf), ...),
specifically in the "easy" cases where buf is allocated with a size
known at compile time.
The changes make sure we are not write outside array/string bounds which
will lead to undefined behaviour. In case the code is trying to write
outside bounds - safe version of functions simply cut the string
messages so we process this gracefully.
All new code of the whole pull request, including one or several files
that are either new files or modified ones, are contributed under the BSD-new
license. I am contributing on behalf of my employer Amazon Web Services,
Inc.
bsonudf.cpp warnings cleanup by Daniel Black
Reviewer: Daniel Black
---------------------------------------------------------
- Temporarily fix MDEV-13782 by commenting out LIKE_FUNC i, CondFilter
modified: storage/connect/ha_connect.cc
- Make Rest available for MariaDB binary distributed versions.
modified: storage/connect/CMakeLists.txt
- Remove unused declaration
modified: storage/connect/filter.h
This new CONNECT version 1.07 fully implements NOSQL support.
It allows working on JSON or XML data retrieved as REST query results
from all binary distributions of MariaDB when cpprestsdk is installed
and the GetRest library is available.
=====================================================================
- Make Rest available for MariaDB binary distributed versions.
Change RestGet function so it can be called from a library.
modified: storage/connect/CMakeLists.txt
modified: storage/connect/restget.cpp
modified: storage/connect/tabrest.cpp
- Make column FLAG option available to discovery functions.
modified: storage/connect/ha_connect.cc
modified: storage/connect/plgdbsem.h
- Update CONNECT version number and date.
modified: storage/connect/ha_connect.cc
- Move OEMColumns function from mycat.cc to reldef.cpp.
modified: storage/connect/mycat.cc
modified: storage/connect/reldef.cpp
- Allocate tables as TABREF (was RELDEF)
modified: storage/connect/mycat.cc
modified: storage/connect/mycat.h
- Fix MDEV-20845 by commenting out TIMEOUT setting.
modified: storage/connect/myconn.cpp
- Call DefineAM before calling GetColCatInfo. Column offset
is now based on record format instead of table type.
The RECFM_VCT format was added.
This enables tables to specify the record format and is
useful in particular for OEM tables.
modified: storage/connect/plgdbsem.h
modified: storage/connect/reldef.cpp
modified: storage/connect/reldef.h
modified: storage/connect/tabdos.cpp
modified: storage/connect/tabdos.h
modified: storage/connect/tabfix.cpp
modified: storage/connect/tabfmt.cpp
modified: storage/connect/tabmysql.cpp
modified: storage/connect/tabutil.cpp
modified: storage/connect/tabutil.h
modified: storage/connect/tabvct.cpp
modified: storage/connect/xindex.cpp
cmake -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ -DCMAKE_BUILD_TYPE=Debug
Maintainer mode makes all warnings errors. This patch fix warnings. Mostly about
deprecated `register` keyword.
Too much warnings came from Mroonga and I gave up on it.
extra/mariabackup/fil_cur.cc:361:42: warning: format specifies type 'unsigned long' but the argument has type 'ib_int64_t' (aka 'long long') [-Wformat]
extra/mariabackup/fil_cur.cc:376:9: warning: format specifies type 'unsigned long' but the argument has type 'ib_int64_t' (aka 'long long') [-Wformat]
sql/handler.cc:6196:45: warning: format specifies type 'unsigned long' but the argument has type 'wsrep_trx_id_t' (aka 'unsigned long long') [-Wformat]
sql/log.cc:1681:16: warning: format specifies type 'unsigned long' but the argument has type 'size_t' (aka 'unsigned int') [-Wformat]
sql/log.cc:1687:16: warning: format specifies type 'unsigned long' but the argument has type 'size_t' (aka 'unsigned int') [-Wformat]
sql/wsrep_sst.cc:1388:86: warning: format specifies type 'long' but the argument has type 'wsrep_seqno_t' (aka 'long long') [-Wformat]
sql/wsrep_sst.cc:232:86: warning: format specifies type 'long' but the argument has type 'wsrep_seqno_t' (aka 'long long') [-Wformat]
storage/connect/filamdbf.cpp:450:47: warning: format specifies type 'short' but the argument has type 'int' [-Wformat]
storage/connect/filamdbf.cpp:970:47: warning: format specifies type 'short' but the argument has type 'int' [-Wformat]
storage/connect/inihandl.cpp:197:16: warning: address of array 'key->name' will always evaluate to 'true' [-Wpointer-bool-conversion]
storage/innobase/btr/btr0scrub.cc:151:17: warning: format specifies type 'long' but the argument has type 'int' [-Wformat]
storage/innobase/buf/buf0buf.cc:5085:8: warning: nonnull parameter 'bpage' will evaluate to 'true' on first encounter [-Wpointer-bool-conversion]
storage/innobase/fil/fil0crypt.cc:2454:5: warning: format specifies type 'long' but the argument has type 'int' [-Wformat]
storage/innobase/handler/ha_innodb.cc:18685:7: warning: format specifies type 'unsigned long' but the argument has type 'wsrep_trx_id_t' (aka 'unsigned long long') [-Wformat]
storage/innobase/row/row0mysql.cc:3319:5: warning: format specifies type 'long' but the argument has type 'int' [-Wformat]
storage/innobase/row/row0mysql.cc:3327:5: warning: format specifies type 'long' but the argument has type 'int' [-Wformat]
storage/maria/ma_norec.c:35:10: warning: implicit conversion from 'int' to 'my_bool' (aka 'char') changes value from 131 to -125 [-Wconstant-conversion]
storage/maria/ma_norec.c:42:10: warning: implicit conversion from 'int' to 'my_bool' (aka 'char') changes value from 131 to -125 [-Wconstant-conversion]
storage/maria/ma_test2.c:1009:12: warning: format specifies type 'unsigned long' but the argument has type 'size_t' (aka 'unsigned int') [-Wformat]
storage/maria/ma_test2.c:1010:12: warning: format specifies type 'unsigned long' but the argument has type 'size_t' (aka 'unsigned int') [-Wformat]
storage/mroonga/ha_mroonga.cpp:9189:44: warning: use of logical '&&' with constant operand [-Wconstant-logical-operand]
storage/mroonga/vendor/groonga/lib/expr.c:4987:22: warning: comparison of constant -1 with expression of type 'grn_operator' is always false [-Wtautological-constant-out-of-range-compare]
storage/xtradb/btr/btr0scrub.cc:151:17: warning: format specifies type 'long' but the argument has type 'int' [-Wformat]
storage/xtradb/buf/buf0buf.cc:5047:8: warning: nonnull parameter 'bpage' will evaluate to 'true' on first encounter [-Wpointer-bool-conversion]
storage/xtradb/fil/fil0crypt.cc:2454:5: warning: format specifies type 'long' but the argument has type 'int' [-Wformat]
storage/xtradb/row/row0mysql.cc:3324:5: warning: format specifies type 'long' but the argument has type 'int' [-Wformat]
storage/xtradb/row/row0mysql.cc:3332:5: warning: format specifies type 'long' but the argument has type 'int' [-Wformat]
unittest/sql/mf_iocache-t.cc:120:35: warning: format specifies type 'unsigned long' but the argument has type 'int' [-Wformat]
unittest/sql/mf_iocache-t.cc:96:35: note: expanded from macro 'INFO_TAIL'
Seems due to making an index on unsigned integer that triggers an
un-handled THROW.
modified: storage/connect/tabdos.cpp
modified: storage/connect/xindex.cpp
Do not silence uncertain cases, or fix any bugs.
The only functional change should be that ha_federated::extra()
is not calling DBUG_PRINT to report an unhandled case for
HA_EXTRA_PREPARE_FOR_DROP.
modified: storage/connect/ha_connect.cc
Add conditional SE exception support
modified: storage/connect/json.cpp
modified: storage/connect/plgdbutl.cpp
Change %p in %x in some sprintf functions.
This to avoid some compiler warnings.
modified: storage/connect/tabwmi.cpp
modified: storage/connect/tabxml.cpp
modified: storage/connect/value.h
Add JavaWrappers.jar to the class path
modified: storage/connect/jdbconn.cpp
Fix wrong declare (char *buf[256]; --> char buf[256];)
modified: storage/connect/xindex.cpp
Now it is also possible to escape it by a backslash.
modified: storage/connect/tabfmt.cpp
- Prepare making VEC table type support conditional.
VEC tables might be unsupported in future versions
modified: storage/connect/CMakeLists.txt
modified: storage/connect/mycat.cc
modified: storage/connect/reldef.cpp
modified: storage/connect/xindex.cpp
- MDEV-11067 suggested to add configuration support to the Apache wrapper.
Was added but commented out until prooved it is really useful.
modified: storage/connect/ApacheInterface.java
modified: storage/connect/ha_connect.cc
modified: storage/connect/jdbccat.h
modified: storage/connect/jdbconn.cpp
modified: storage/connect/jdbconn.h
modified: storage/connect/tabjdbc.cpp
modified: storage/connect/tabjdbc.h
- Remove useless members.
modified: storage/connect/jdbconn.cpp
modified: storage/connect/jdbconn.h
- New UDF countin.
modified: storage/connect/jsonudf.cpp
modified: storage/connect/jsonudf.h
modified: storage/connect/JdbcInterface.java
- Change Version number and date
modified: storage/connect/ha_connect.cc
- Implement the test on connect_type_conv YES/NO
modified: storage/connect/jdbconn.cpp
modified: storage/connect/odbconn.cpp
- Fix MDEV-10520. Local schema was confused with remote schema
modified: storage/connect/tabjdbc.cpp
modified: storage/connect/tabodbc.cpp
- Fix crash when using mapped indices. Was trying to write in a mapped
file declared as read only.
modified: storage/connect/xindex.cpp
Spider:
SunPro only supports array declarations with
constant size. Spider already has a workaround for
that, inside #ifdef _MSC_VER. Enable this code
also for __SUNPRO_CC
Connect:
Don't use anonymous union.
Cast for mmap.
Don't pass gcc-ish -W... options to SunPro
Was added in function TranslateSQLType.
modified: storage/connect/ha_connect.cc
modified: storage/connect/odbconn.cpp
modified: storage/connect/value.h
Add some trace in particular in indexing routines.
modified: storage/connect/block.h
modified: storage/connect/ha_connect.cc
modified: storage/connect/plugutil.c
modified: storage/connect/xindex.cpp
modified: storage/connect/xindex.h
They are still experimental and should not be used in production.
added:
storage/connect/encas.h
storage/connect/english.msg
storage/connect/enids.h
storage/connect/frcas.h
storage/connect/french.msg
storage/connect/frids.h
storage/connect/frmsg.h
modified:
storage/connect/connect.cc
storage/connect/engmsg.h
storage/connect/filamdbf.cpp
storage/connect/global.h
storage/connect/ha_connect.cc
storage/connect/msgid.h
storage/connect/plgdbutl.cpp
storage/connect/plugutil.c
storage/connect/rcmsg.c
storage/connect/resource.h
storage/connect/tabfmt.h
- Fix global variable not being properly initialized (MDEV-6690, MDEV-7094)
modified:
storage/connect/ha_connect.cc
storage/connect/plugutil.c
storage/connect/user_connect.cc
storage/connect/xindex.cpp
- Implement Rewind for ODBC tables (MDEV-7097)
modified:
storage/connect/odbconn.cpp
storage/connect/odbconn.h
storage/connect/tabmysql.cpp
storage/connect/tabodbc.cpp
- Reset N when reopening MYSQL tables
modified:
storage/connect/tabmysql.cpp
the beginning. Defining the STRING class and begining to use it (MYSQL)
2) Change the xtrace, use_tempfile and exact_info connect variables from
GLOBAL to SESSION. Remaining GLOBAL variables have been made readonly.
3) Take care of LEX_STRING variables. The .str should not be regarded as
allways being 0 terminated. This is handled by the Strz functions that
make sure to return 0 terminated strings.
Bug fix:
- When inserting in MYSQL table with special column(s) a query such as:
insert into t2 values(0,4,'new04'),(0,5,'new05');
failed saying: column id (the special column) not found in t2.
It is now accepted but must be counted in values (these 0 are ignored)
- ROWID was returning row numbers based 0. Now it is from base 1.
modified:
storage/connect/array.cpp
storage/connect/blkfil.cpp
storage/connect/colblk.cpp
storage/connect/connect.cc
storage/connect/filamap.cpp
storage/connect/filamdbf.cpp
storage/connect/filamfix.cpp
storage/connect/filamtxt.cpp
storage/connect/filamvct.cpp
storage/connect/filamzip.cpp
storage/connect/filamzip.h
storage/connect/filter.cpp
storage/connect/global.h
storage/connect/ha_connect.cc
storage/connect/ha_connect.h
storage/connect/libdoc.cpp
storage/connect/mycat.cc
storage/connect/myconn.cpp
storage/connect/odbconn.cpp
storage/connect/plgdbutl.cpp
storage/connect/plugutil.c
storage/connect/reldef.cpp
storage/connect/tabcol.cpp
storage/connect/tabdos.cpp
storage/connect/tabfix.cpp
storage/connect/tabfmt.cpp
storage/connect/table.cpp
storage/connect/tabmul.cpp
storage/connect/tabmysql.cpp
storage/connect/tabmysql.h
storage/connect/taboccur.cpp
storage/connect/tabodbc.cpp
storage/connect/tabpivot.cpp
storage/connect/tabsys.cpp
storage/connect/tabtbl.cpp
storage/connect/tabutil.cpp
storage/connect/tabvct.cpp
storage/connect/tabwmi.cpp
storage/connect/tabwmi.h
storage/connect/tabxcl.cpp
storage/connect/tabxml.cpp
storage/connect/user_connect.cc
storage/connect/valblk.cpp
storage/connect/value.cpp
storage/connect/value.h
storage/connect/xindex.cpp
storage/connect/xobject.cpp
storage/connect/xobject.h
storage/connect/xtable.h
that uninitialised characters be written in op file.
modified:
storage/connect/tabdos.cpp
- Typo
modified:
storage/connect/filamap.cpp
storage/connect/filamdbf.cpp
storage/connect/filamdbf.h
storage/connect/valblk.cpp
storage/connect/xindex.cpp
while returning an error on Linux. Now accepted on linux.
modified:
storage/connect/maputil.cpp
- Fix a BUG in the XHUGE class. lseek64 was wrongly regarded as in error
when returning 0 instead of -1. This produced wrong index files.
modified:
storage/connect/filamfix.cpp
storage/connect/maputil.cpp
storage/connect/xindex.cpp
- Fix length mismatch (tab instead of blanks?)
modified:
storage/connect/mysql-test/connect/r/updelx.result
a temporary file should be used for UPDATE/DELETE of file tables.
Also use the "sorted" argument of index_init to help decide if
sorting of positions must be done.
modified:
storage/connect/checklvl.h
storage/connect/connect.cc
storage/connect/connect.h
storage/connect/filamdbf.cpp
storage/connect/filamfix.cpp
storage/connect/filamfix.h
storage/connect/filamtxt.cpp
storage/connect/ha_connect.cc
storage/connect/mysql-test/connect/r/part_table.result
storage/connect/plgdbsem.h
storage/connect/plgdbutl.cpp
storage/connect/reldef.cpp
storage/connect/tabdos.cpp
storage/connect/tabdos.h
storage/connect/tabfix.cpp
storage/connect/tabfmt.cpp
storage/connect/tabvct.cpp
storage/connect/tabvct.h
storage/connect/xindex.cpp
- Fix a bug in TDBASE::ColDB that caused some special columns not to
be found in the column list and reallocated without their Value
causing a crash of some queries.
modified:
storage/connect/table.cpp
- Fix a bug causing RestoreNrec to be called before closing a table
causing a wrong value given to Spos
modified:
storage/connect/tabdos.cpp
storage/connect/xindex.cpp
- Add a new CONNECT global variable connect_exact_info. Set to ON, it
tells CONNECT to return exact record numbers on info queries. If OFF
it just gives an estimate. In version 10.0.13 this was unconditionally
ON and caused info queries on remote tables to be extremely long and
was the subject of MDEV-6612.
modified:
storage/connect/ha_connect.cc
storage/connect/tabdos.cpp
storage/connect/tabmysql.cpp
storage/connect/tabodbc.cpp
them sorted by file position. Firstly a new value is stored in indexes
to know if they are sorted, preventing to do the sorting when it is not
needed. Secondly, almost all in now done in connect instead of being
done by the different file access method classes. This pepares the future
use of temporary files for all table types and also fix the bug that was
occuring when partially using a multi-column index because of false MRR
like call of position followed by unsorted rnd_pos no more using indexing.
modified:
storage/connect/connect.cc
storage/connect/filamap.cpp
storage/connect/filamap.h
storage/connect/filamdbf.cpp
storage/connect/filamdbf.h
storage/connect/filamfix.cpp
storage/connect/filamfix.h
storage/connect/filamtxt.cpp
storage/connect/filamtxt.h
storage/connect/filamvct.cpp
storage/connect/filamvct.h
storage/connect/tabdos.cpp
storage/connect/tabdos.h
storage/connect/tabfix.h
storage/connect/tabfmt.cpp
storage/connect/tabfmt.h
storage/connect/xindex.cpp
storage/connect/xindex.h
storage/connect/xtable.h
