Merge 10.6 into 10.11

grooverdan · grooverdan · commit f249b0196d9a · 2026-06-26T17:56:20.000+10:00
diff --git a/include/json_lib.h b/include/json_lib.h
@@ -30,6 +30,7 @@ enum json_errors {
   JE_ESCAPING= -6,     /* Error in the escaping. */
 
   JE_DEPTH= -7,        /* The limit on the JSON depth was overrun. */
+  JE_KILLED= -8,       /* Killed during processing */
 };
 
 
diff --git a/mysql-test/main/column_compression.result b/mysql-test/main/column_compression.result
@@ -3035,3 +3035,19 @@ select * from (select * from t) as t natural join (select * from t) as t1;
 a	b
 drop tables t, t4;
 # End of 10.5 tests
+#
+# MDEV-39450: Memory corruption: overlapping memory ranges in `Field_longstr::compress` on UPDATE of compressed column
+#
+CREATE TABLE t (c VARCHAR(255) COMPRESSED);
+REPLACE INTO t VALUES ('abcdefghijklm');
+UPDATE t SET c=RIGHT(c,10);
+DROP TABLE t;
+CREATE TABLE t (c VARCHAR(255) COMPRESSED);
+REPLACE INTO t VALUES ('abcdefghijklm');
+UPDATE t SET c=SUBSTRING(c,3);
+DROP TABLE t;
+CREATE TABLE t (c VARCHAR(255) COMPRESSED);
+REPLACE INTO t VALUES ('abcdefghijklm');
+UPDATE t SET c=MID(c,2,4);
+DROP TABLE t;
+# End of 10.6 tests
diff --git a/mysql-test/main/column_compression.test b/mysql-test/main/column_compression.test
@@ -573,3 +573,24 @@ select * from (select * from t) as t natural join (select * from t) as t1;
 drop tables t, t4;
 
 --echo # End of 10.5 tests
+
+--echo #
+--echo # MDEV-39450: Memory corruption: overlapping memory ranges in `Field_longstr::compress` on UPDATE of compressed column
+--echo #
+
+CREATE TABLE t (c VARCHAR(255) COMPRESSED);
+REPLACE INTO t VALUES ('abcdefghijklm');
+UPDATE t SET c=RIGHT(c,10);
+DROP TABLE t;
+
+CREATE TABLE t (c VARCHAR(255) COMPRESSED);
+REPLACE INTO t VALUES ('abcdefghijklm');
+UPDATE t SET c=SUBSTRING(c,3);
+DROP TABLE t;
+
+CREATE TABLE t (c VARCHAR(255) COMPRESSED);
+REPLACE INTO t VALUES ('abcdefghijklm');
+UPDATE t SET c=MID(c,2,4);
+DROP TABLE t;
+
+--echo # End of 10.6 tests
diff --git a/mysql-test/main/func_json.result b/mysql-test/main/func_json.result
@@ -1779,6 +1779,8 @@ Warning	4042	Syntax error in JSON path in argument 2 to function 'json_extract'
 SELECT JSON_EXISTS(CONCAT('[', REPEAT('[', 4000), 'Y', REPEAT(']', 4000), ', 1]'), '$[100]') as ex;
 ex
 NULL
+Warnings:
+Warning	4040	Limit of 32 on JSON nested structures depth is reached in argument 1 to function 'json_exists' at position 32
 #
 # MDEV-35548 UBSAN: runtime error: index -1 out of bounds for type 'json_path_step_t[32]'
 # (aka 'struct st_json_path_step_t[32]')
@@ -1794,6 +1796,18 @@ JSON_EXTRACT('0E+0','$')
 SELECT JSON_EXISTS(CONCAT('[', REPEAT('[', 4000), 'Y', REPEAT(']', 4000), ', 1]'), '$[100]') as je;
 je
 NULL
+Warnings:
+Warning	4040	Limit of 32 on JSON nested structures depth is reached in argument 1 to function 'json_exists' at position 32
+SELECT JSON_EXISTS('[[[[[Y[[[[n[[[[[[[[[[[n[[[Vn]]]]]]]]]]]]]],]]:]]]](', '$[0 to rrrrrRR-1]') as je;
+je
+NULL
+Warnings:
+Warning	4038	Syntax error in JSON text in argument 1 to function 'json_exists' at position 6
+SELECT JSON_EXISTS('[[[[[Y[[[[[[[[[[[[[[[[[[Vn]]]]]]]]]]]]]],]]:]]]](', '$[0 to rrrrRR-1]') as je;
+je
+NULL
+Warnings:
+Warning	4038	Syntax error in JSON text in argument 1 to function 'json_exists' at position 6
 # End of 10.6 tests
 SELECT json_extract(t.j, '$')
 FROM (SELECT json_extract('["a",1]', '$') AS j) AS t;
diff --git a/mysql-test/main/func_json.test b/mysql-test/main/func_json.test
@@ -1248,6 +1248,8 @@ SELECT JSON_EXTRACT('{a:true}','$.a')=TRUE;
 SELECT JSON_EXTRACT('0E+0','$');
 
 SELECT JSON_EXISTS(CONCAT('[', REPEAT('[', 4000), 'Y', REPEAT(']', 4000), ', 1]'), '$[100]') as je;
+SELECT JSON_EXISTS('[[[[[Y[[[[n[[[[[[[[[[[n[[[Vn]]]]]]]]]]]]]],]]:]]]](', '$[0 to rrrrrRR-1]') as je;
+SELECT JSON_EXISTS('[[[[[Y[[[[[[[[[[[[[[[[[[Vn]]]]]]]]]]]]]],]]:]]]](', '$[0 to rrrrRR-1]') as je;
 
 --echo # End of 10.6 tests
 
diff --git a/mysql-test/main/func_json_notembedded.result b/mysql-test/main/func_json_notembedded.result
@@ -20,8 +20,18 @@ select json_insert(@obj, '$.meta', 1);
 ERROR 70100: Query execution was interrupted (max_statement_time exceeded)
 select json_compact(@arr);
 ERROR 70100: Query execution was interrupted (max_statement_time exceeded)
+select json_contains(@obj, '"d"', '$.c');
+ERROR 70100: Query execution was interrupted (max_statement_time exceeded)
+select json_contains_path(@obj, 'one', '$.c');
+ERROR 70100: Query execution was interrupted (max_statement_time exceeded)
+select json_exists(@obj, '$.c');
+ERROR 70100: Query execution was interrupted (max_statement_time exceeded)
+select json_extract(@obj, '$.c');
+ERROR 70100: Query execution was interrupted (max_statement_time exceeded)
 select json_detailed(@arr);
 ERROR 70100: Query execution was interrupted (max_statement_time exceeded)
+select json_keys(@obj, '$.c');
+ERROR 70100: Query execution was interrupted (max_statement_time exceeded)
 select json_loose(@arr);
 ERROR 70100: Query execution was interrupted (max_statement_time exceeded)
 select json_merge(@obj, @arr);
@@ -36,6 +46,8 @@ select json_replace(@obj,'$.foo',1);
 ERROR 70100: Query execution was interrupted (max_statement_time exceeded)
 select json_set(@arr,'$[1000]',1);
 ERROR 70100: Query execution was interrupted (max_statement_time exceeded)
+select ST_AsTEXT(ST_GeomFromGeoJSON(JSON_OBJECT("type", "Point", "coordinates", @arr),2)) as exp;
+ERROR 70100: Query execution was interrupted (max_statement_time exceeded)
 SET debug_dbug= @old_debug;
 disconnect u;
 connection default;
diff --git a/mysql-test/main/func_json_notembedded.test b/mysql-test/main/func_json_notembedded.test
@@ -23,14 +23,20 @@ select json_array_append(@arr, '$[0]', 1);
 select json_array_insert(@arr, '$[0]', 1);
 select json_insert(@obj, '$.meta', 1);
 select json_compact(@arr);
+select json_contains(@obj, '"d"', '$.c');
+select json_contains_path(@obj, 'one', '$.c');
+select json_exists(@obj, '$.c');
+select json_extract(@obj, '$.c');
 select json_detailed(@arr);
+select json_keys(@obj, '$.c');
 select json_loose(@arr);
 select json_merge(@obj, @arr);
 select json_merge_patch(@obj, @obj);
 select json_merge_preserve(@obj, @arr);
 select json_remove(@obj,'$.foo');
 select json_replace(@obj,'$.foo',1);
 select json_set(@arr,'$[1000]',1);
+select ST_AsTEXT(ST_GeomFromGeoJSON(JSON_OBJECT("type", "Point", "coordinates", @arr),2)) as exp;
 enable_abort_on_error;
 SET debug_dbug= @old_debug;
 disconnect u;
diff --git a/mysql-test/main/gis-json.result b/mysql-test/main/gis-json.result
@@ -124,6 +124,20 @@ Warning	4048	Incorrect GeoJSON format specified for st_geomfromgeojson function.
 # End of 10.2 tests
 #
 #
+# MDEV-39813 ST_GeomFromGeoJSON does not control recursion depth
+#
+SELECT ST_GeomFromGeoJSON(
+concat(
+repeat('{"type":"GeometryCollection","geometries":[', 2000),
+'{"type":"Point","coordinates":[0,0]}',
+repeat(']}', 2000)
+)) as exp;
+exp
+NULL
+Warnings:
+Warning	4040	Limit of 32 on JSON nested structures depth is reached in argument 1 to function 'st_geomfromgeojson' at position 473
+# End of 10.6 tests
+#
 # MDEV-34079: ST_AsGeoJSON returns incorrect value for empty geometry
 #
 SELECT ST_AsGeoJSON(GeomFromText('GeometryCollection EMPTY'));
diff --git a/mysql-test/main/gis-json.test b/mysql-test/main/gis-json.test
@@ -58,6 +58,20 @@ SELECT ST_ASTEXT(ST_GEOMFROMGEOJSON('{"type": ["POINT"], "coINates": [0,0] }'))
 --echo #
 --echo # End of 10.2 tests
 --echo #
+
+--echo #
+--echo # MDEV-39813 ST_GeomFromGeoJSON does not control recursion depth
+--echo #
+
+SELECT ST_GeomFromGeoJSON(
+  concat(
+    repeat('{"type":"GeometryCollection","geometries":[', 2000),
+    '{"type":"Point","coordinates":[0,0]}',
+    repeat(']}', 2000)
+  )) as exp;
+
+--echo # End of 10.6 tests
+
 --echo #
 --echo # MDEV-34079: ST_AsGeoJSON returns incorrect value for empty geometry
 --echo #
diff --git a/mysql-test/suite/s3/debug.result b/mysql-test/suite/s3/debug.result
@@ -2,9 +2,12 @@ drop table if exists t1;
 #
 # MDEV-32884 Make s3_debug dynamic
 #
+set @save_s3_debug=@@global.s3_debug;
 create or replace table t1 (a int, b int, c varchar(1000), key (a), key(c)) engine=aria;
 insert into t1 select seq, seq+10, repeat(char(65+ mod(seq, 20)),mod(seq,1000)) from seq_1_to_100;
+create table t2 as select * from t1;
 alter table t1 engine=s3;
+alter table t2 engine=s3;
 show create table t1;
 Table	Create Table
 t1	CREATE TABLE `t1` (
@@ -17,16 +20,17 @@ t1	CREATE TABLE `t1` (
 select count(*) from t1;
 count(*)
 100
-flush table t1;
-NOT FOUND /s3_test_/ in mysqld.1.err
+flush table t1, t2;
+NOT FOUND matches in mysqld.1.err
 set @@global.s3_debug=1;
 select count(*) from t1;
 count(*)
 100
 set @@global.s3_debug=0;
-FOUND 8 /s3_test_/ in mysqld.1.err
-select count(*) from t1;
+FOUND NUMBER matches in mysqld.1.err
+select count(*) from t2;
 count(*)
 100
-drop table t1;
-FOUND 8 /s3_test_/ in mysqld.1.err
+drop table t1, t2;
+NOT FOUND matches in mysqld.1.err
+set @@global.s3_debug=@save_s3_debug;
diff --git a/mysql-test/suite/s3/debug.test b/mysql-test/suite/s3/debug.test
@@ -13,22 +13,29 @@ drop table if exists t1;
 --echo # MDEV-32884 Make s3_debug dynamic
 --echo #
 
+set @save_s3_debug=@@global.s3_debug;
 create or replace table t1 (a int, b int, c varchar(1000), key (a), key(c)) engine=aria;
 insert into t1 select seq, seq+10, repeat(char(65+ mod(seq, 20)),mod(seq,1000)) from seq_1_to_100;
+create table t2 as select * from t1;
 alter table t1 engine=s3;
+alter table t2 engine=s3;
 show create table t1;
 select count(*) from t1;
-flush table t1;
+flush table t1, t2;
 
 --let SEARCH_FILE=$MYSQLTEST_VARDIR/log/mysqld.1.err
---let SEARCH_PATTERN=s3_test_
+--let SEARCH_PATTERN=$database/t1
+--let SEARCH_OUTPUT=count
 --source include/search_pattern_in_file.inc
 set @@global.s3_debug=1;
 select count(*) from t1;
 set @@global.s3_debug=0;
+--replace_regex / [0-9]+/ NUMBER/
 --source include/search_pattern_in_file.inc
-select count(*) from t1;
-drop table t1;
+select count(*) from t2;
+drop table t1, t2;
+--let SEARCH_PATTERN=$database/t2
 --source include/search_pattern_in_file.inc
 
+set @@global.s3_debug=@save_s3_debug;
 --source drop_database.inc
diff --git a/sql/field.cc b/sql/field.cc
@@ -8601,7 +8601,7 @@ int Field_longstr::compress(char *to, uint to_length,
     /* Store uncompressed */
     to[0]= 0;
     if (buf_length < to_length)
-      memcpy(to + 1, buf, buf_length);
+      memmove(to + 1, buf, buf_length);
     else
     {
       /* Storing string at blob capacity, e.g. 255 bytes string to TINYBLOB. */
diff --git a/sql/item_geofunc.cc b/sql/item_geofunc.cc
@@ -161,6 +161,7 @@ String *Item_func_geometry_from_json::val_str(String *str)
 
   json_scan_start(&je, js->charset(), (const uchar *) js->ptr(),
                   (const uchar *) js->end());
+  je.killed_ptr= (uint32_t *) &current_thd->killed;
 
   if ((null_value= !Geometry::create_from_json(&buffer, &je, options==1,  str)))
   {
diff --git a/sql/item_jsonfunc.cc b/sql/item_jsonfunc.cc
diff --git a/sql/spatial.cc b/sql/spatial.cc
diff --git a/strings/json_lib.c b/strings/json_lib.c
diff --git a/support-files/wsrep.cnf.sh b/support-files/wsrep.cnf.sh
