Merge pull request #1985 from Altinity/rebase-cicd-v26.3.16.16-lts

Stable 26.3 - Rebase to v26.3.16.16 lts

Author: strtgbb

.github/workflows/master.yml

@@ -5727,25 +5727,6 @@ jobs:
       timeout_minutes: 210
       workflow_config: ${{ needs.config_workflow.outputs.data }}
 
-  SignRelease:
-    needs: [config_workflow, build_amd_release]
-    if: ${{ !failure() && !cancelled() }}
-    uses: ./.github/workflows/reusable_sign.yml
-    secrets: inherit
-    with:
-      test_name: Sign release
-      runner_type: altinity-style-checker
-      data: ${{ needs.config_workflow.outputs.data }}
-  SignAarch64:
-    needs: [config_workflow, build_arm_release]
-    if: ${{ !failure() && !cancelled() }}
-    uses: ./.github/workflows/reusable_sign.yml
-    secrets: inherit
-    with:
-      test_name: Sign aarch64
-      runner_type: altinity-style-checker-aarch64
-      data: ${{ needs.config_workflow.outputs.data }}
-
   FinishCIReport:
     if: ${{ !cancelled() && needs.config_workflow.outputs.pipeline_status != '' }}
     needs:
@@ -5870,8 +5851,6 @@ jobs:
       - GrypeScanKeeper
       - RegressionTestsRelease
       - RegressionTestsAarch64
-      - SignRelease
-      - SignAarch64
     runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
     steps:
       - name: Check out repository code

base/poco/JSON/include/Poco/JSON/ParserImpl.h

@@ -43,6 +43,9 @@ namespace JSON
         static const std::size_t JSON_PARSE_BUFFER_SIZE = 4096;
         static const std::size_t JSON_PARSER_STACK_SIZE = 128;
         static const int JSON_UNLIMITED_DEPTH = -1;
+        /// Default nesting limit so that parsing untrusted JSON cannot overflow the native stack via
+        /// Poco's recursive descent. Far above any legitimate JSON; raise per-parser with setDepth.
+        static const int JSON_DEFAULT_DEPTH = 1000;
 
         ParserImpl(const Handler::Ptr & pHandler = new ParseHandler, std::size_t bufSize = JSON_PARSE_BUFFER_SIZE);
         /// Creates JSON ParserImpl, using the given Handler and buffer size.
@@ -109,6 +112,7 @@ namespace JSON
         struct json_stream * _pJSON;
         Handler::Ptr _pHandler;
         int _depth;
+        int _currentDepth = 0;
         char _decimalPoint;
         bool _allowNullByte;
         bool _allowComments;

base/poco/JSON/src/ParserImpl.cpp

@@ -37,7 +37,7 @@ namespace JSON {
 ParserImpl::ParserImpl(const Handler::Ptr& pHandler, std::size_t bufSize):
 	_pJSON(new json_stream),
 	_pHandler(pHandler),
-	_depth(JSON_UNLIMITED_DEPTH),
+	_depth(JSON_DEFAULT_DEPTH),
 	_decimalPoint('.'),
 	_allowNullByte(true),
 	_allowComments(false)
@@ -53,6 +53,7 @@ ParserImpl::~ParserImpl()
 
 void ParserImpl::handle(const std::string& json)
 {
+	_currentDepth = 0;
 	if (!_allowNullByte && json.find("\\u0000") != json.npos)
 		throw JSONException("Null bytes in strings not allowed.");
 
@@ -139,6 +140,12 @@ void ParserImpl::stripComments(std::string& json)
 
 void ParserImpl::handleArray()
 {
+	// Enforce the configured depth limit (set via setDepth) to avoid a native-stack
+	// overflow on deeply nested input. _depth == JSON_UNLIMITED_DEPTH (-1) means no limit.
+	if (_depth != JSON_UNLIMITED_DEPTH && _currentDepth >= _depth)
+		throw JSONException("Maximum allowed JSON depth exceeded");
+	++_currentDepth;
+
 	json_type tok = json_peek(_pJSON);
 	while (tok != JSON_ARRAY_END && checkError())
 	{
@@ -148,11 +155,17 @@ void ParserImpl::handleArray()
 
 	if (tok == JSON_ARRAY_END) handle();
 	else throw JSONException("JSON array end not found");
+
+	--_currentDepth;
 }
 
 
 void ParserImpl::handleObject()
 {
+	if (_depth != JSON_UNLIMITED_DEPTH && _currentDepth >= _depth)
+		throw JSONException("Maximum allowed JSON depth exceeded");
+	++_currentDepth;
+
 	json_type tok = json_peek(_pJSON);
 	while (tok != JSON_OBJECT_END && checkError())
 	{
@@ -166,6 +179,8 @@ void ParserImpl::handleObject()
 
 	if (tok == JSON_OBJECT_END) handle();
 	else throw JSONException("JSON object end not found");
+
+	--_currentDepth;
 }
 
 

ci/workflows/master.py

@@ -65,7 +65,6 @@
     additional_jobs=[
         "GrypeScan",
         "Regression",
-        "SignRelease",
         "CIReport",
         "SourceUpload",
     ],

cmake/autogenerated_versions.txt

@@ -2,13 +2,13 @@
 
 # NOTE: VERSION_REVISION has nothing common with DBMS_TCP_PROTOCOL_VERSION,
 # only DBMS_TCP_PROTOCOL_VERSION should be incremented on protocol changes.
-SET(VERSION_REVISION 54520)
+SET(VERSION_REVISION 54523)
 SET(VERSION_MAJOR 26)
 SET(VERSION_MINOR 3)
-SET(VERSION_PATCH 13)
-SET(VERSION_GITHASH d23c7536b980c34b39c850b08ef23c509f06aaaa)
-SET(VERSION_DESCRIBE v26.3.13.10001.altinitytest)
-SET(VERSION_STRING 26.3.13.10001.altinitytest)
+SET(VERSION_PATCH 16)
+SET(VERSION_GITHASH 3c767441a1ed9b5828b94806d87a25501d1f7364)
+SET(VERSION_DESCRIBE v26.3.16.10001.altinitytest)
+SET(VERSION_STRING 26.3.16.10001.altinitytest)
 # end of autochange
 
 SET(VERSION_TWEAK 10001)

contrib/avro

@@ -15,6 +15,7 @@ set (SRCS
     "${LIBRARY_DIR}/lib/asyn-thrdd.c"
     "${LIBRARY_DIR}/lib/bufq.c"
     "${LIBRARY_DIR}/lib/bufref.c"
+    "${LIBRARY_DIR}/lib/cf-dns.c"
     "${LIBRARY_DIR}/lib/cf-h1-proxy.c"
     "${LIBRARY_DIR}/lib/cf-h2-proxy.c"
     "${LIBRARY_DIR}/lib/cf-haproxy.c"
@@ -37,7 +38,6 @@ set (SRCS
     "${LIBRARY_DIR}/lib/curl_memrchr.c"
     "${LIBRARY_DIR}/lib/curl_ntlm_core.c"
     "${LIBRARY_DIR}/lib/curl_range.c"
-    "${LIBRARY_DIR}/lib/curl_rtmp.c"
     "${LIBRARY_DIR}/lib/curl_sasl.c"
     "${LIBRARY_DIR}/lib/curl_sha512_256.c"
     "${LIBRARY_DIR}/lib/curl_share.c"
@@ -47,6 +47,7 @@ set (SRCS
     "${LIBRARY_DIR}/lib/cw-out.c"
     "${LIBRARY_DIR}/lib/cw-pause.c"
     "${LIBRARY_DIR}/lib/dict.c"
+    "${LIBRARY_DIR}/lib/dnscache.c"
     "${LIBRARY_DIR}/lib/doh.c"
     "${LIBRARY_DIR}/lib/dynhds.c"
     "${LIBRARY_DIR}/lib/easy.c"
@@ -100,6 +101,7 @@ set (SRCS
     "${LIBRARY_DIR}/lib/pingpong.c"
     "${LIBRARY_DIR}/lib/pop3.c"
     "${LIBRARY_DIR}/lib/progress.c"
+    "${LIBRARY_DIR}/lib/protocol.c"
     "${LIBRARY_DIR}/lib/psl.c"
     "${LIBRARY_DIR}/lib/rand.c"
     "${LIBRARY_DIR}/lib/ratelimit.c"
@@ -123,6 +125,8 @@ set (SRCS
     "${LIBRARY_DIR}/lib/system_win32.c"
     "${LIBRARY_DIR}/lib/telnet.c"
     "${LIBRARY_DIR}/lib/tftp.c"
+    "${LIBRARY_DIR}/lib/thrdpool.c"
+    "${LIBRARY_DIR}/lib/thrdqueue.c"
     "${LIBRARY_DIR}/lib/transfer.c"
     "${LIBRARY_DIR}/lib/uint-bset.c"
     "${LIBRARY_DIR}/lib/uint-hash.c"

contrib/curl

@@ -57,8 +57,10 @@
 
 #define ENABLE_IPV6
 #define USE_OPENSSL
-#define USE_THREADS_POSIX
+#define HAVE_THREADS_POSIX
 #define USE_ARES
+#define USE_RESOLV_ARES
+#define CURL_ENABLE_NTLM
 
 #ifdef __illumos__
 #define HAVE_POSIX_STRERROR_R 1