diff options
| -rw-r--r-- | mysql-cipherspec.patch | 115 | ||||
| -rw-r--r-- | mysql-file-contents.patch | 27 | ||||
| -rw-r--r-- | mysql-plugin-test.patch | 88 | ||||
| -rw-r--r-- | mysql-string-overflow.patch | 52 | ||||
| -rw-r--r-- | mysql55.spec | 40 |
5 files changed, 321 insertions, 1 deletions
diff --git a/mysql-cipherspec.patch b/mysql-cipherspec.patch new file mode 100644 index 0000000..b9180f2 --- /dev/null +++ b/mysql-cipherspec.patch @@ -0,0 +1,115 @@ +Some test items assume the default SSL cipher is DHE-RSA-AES256-SHA, +which is no longer the case as of openssl 1.0.1. +This patch enhances connect command by an option to specify a cipher +and tests are adjusted to specify the expected cipher explicitly. +Upstream bug report: http://bugs.mysql.com/bug.php?id=64461 + +diff -up mysql-5.5.21/client/mysqltest.cc.cipherspec mysql-5.5.21/client/mysqltest.cc +--- mysql-5.5.21/client/mysqltest.cc.cipherspec 2012-01-31 12:28:16.000000000 +0100 ++++ mysql-5.5.21/client/mysqltest.cc 2012-03-09 14:38:37.083890817 +0100 +@@ -5458,6 +5458,7 @@ void do_connect(struct st_command *comma + my_bool con_ssl= 0, con_compress= 0; + my_bool con_pipe= 0, con_shm= 0; + struct st_connection* con_slot; ++ char *con_cipher=NULL; + + static DYNAMIC_STRING ds_connection_name; + static DYNAMIC_STRING ds_host; +@@ -5546,6 +5547,8 @@ void do_connect(struct st_command *comma + con_pipe= 1; + else if (!strncmp(con_options, "SHM", 3)) + con_shm= 1; ++ else if (!strncmp(con_options, "CIPHER:", 7)) ++ con_cipher = con_options + 7; + else + die("Illegal option to connect: %.*s", + (int) (end - con_options), con_options); +@@ -5593,8 +5596,11 @@ void do_connect(struct st_command *comma + if (con_ssl) + { + #if defined(HAVE_OPENSSL) && !defined(EMBEDDED_LIBRARY) ++ /* default cipher */ ++ if (con_cipher == NULL && opt_ssl_cipher != NULL) ++ con_cipher = opt_ssl_cipher; + mysql_ssl_set(&con_slot->mysql, opt_ssl_key, opt_ssl_cert, opt_ssl_ca, +- opt_ssl_capath, opt_ssl_cipher); ++ opt_ssl_capath, con_cipher); + #if MYSQL_VERSION_ID >= 50000 + /* Turn on ssl_verify_server_cert only if host is "localhost" */ + opt_ssl_verify_server_cert= !strcmp(ds_host.str, "localhost"); +diff -up mysql-5.5.21/mysql-test/t/openssl_1.test.cipherspec mysql-5.5.21/mysql-test/t/openssl_1.test +--- mysql-5.5.21/mysql-test/t/openssl_1.test.cipherspec 2012-01-31 12:28:15.000000000 +0100 ++++ mysql-5.5.21/mysql-test/t/openssl_1.test 2012-03-09 14:59:52.305752562 +0100 +@@ -20,13 +20,13 @@ grant select on test.* to ssl_user4@loca + grant select on test.* to ssl_user5@localhost require cipher "DHE-RSA-AES256-SHA" AND SUBJECT "xxx"; + flush privileges; + +-connect (con1,localhost,ssl_user1,,,,,SSL); +-connect (con2,localhost,ssl_user2,,,,,SSL); +-connect (con3,localhost,ssl_user3,,,,,SSL); +-connect (con4,localhost,ssl_user4,,,,,SSL); ++connect (con1,localhost,ssl_user1,,,,,SSL CIPHER:DHE-RSA-AES256-SHA); ++connect (con2,localhost,ssl_user2,,,,,SSL CIPHER:DHE-RSA-AES256-SHA); ++connect (con3,localhost,ssl_user3,,,,,SSL CIPHER:DHE-RSA-AES256-SHA); ++connect (con4,localhost,ssl_user4,,,,,SSL CIPHER:DHE-RSA-AES256-SHA); + --replace_result $MASTER_MYSOCK MASTER_SOCKET $MASTER_MYPORT MASTER_PORT + --error ER_ACCESS_DENIED_ERROR +-connect (con5,localhost,ssl_user5,,,,,SSL); ++connect (con5,localhost,ssl_user5,,,,,SSL CIPHER:DHE-RSA-AES256-SHA); + + connection con1; + # Check ssl turned on +@@ -119,7 +119,7 @@ drop table t1; + # verification of servers certificate by setting both ca certificate + # and ca path to NULL + # +---exec $MYSQL --ssl --ssl-key=$MYSQL_TEST_DIR/std_data/client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/client-cert.pem -e "SHOW STATUS LIKE 'ssl_Cipher'" 2>&1 ++--exec $MYSQL --ssl --ssl-key=$MYSQL_TEST_DIR/std_data/client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/client-cert.pem --ssl-cipher=DHE-RSA-AES256-SHA -e "SHOW STATUS LIKE 'ssl_Cipher'" 2>&1 + --echo End of 5.0 tests + + # +@@ -244,7 +244,7 @@ select 'is still running; no cipher requ + + GRANT SELECT ON test.* TO bug42158@localhost REQUIRE X509; + FLUSH PRIVILEGES; +-connect(con1,localhost,bug42158,,,,,SSL); ++connect(con1,localhost,bug42158,,,,,SSL CIPHER:DHE-RSA-AES256-SHA); + SHOW STATUS LIKE 'Ssl_cipher'; + disconnect con1; + connection default; +diff -up mysql-5.5.21/mysql-test/t/ssl_8k_key.test.cipherspec mysql-5.5.21/mysql-test/t/ssl_8k_key.test +--- mysql-5.5.21/mysql-test/t/ssl_8k_key.test.cipherspec 2012-01-31 12:28:15.000000000 +0100 ++++ mysql-5.5.21/mysql-test/t/ssl_8k_key.test 2012-03-09 14:38:37.084890702 +0100 +@@ -2,7 +2,7 @@ + # + # Bug#29784 YaSSL assertion failure when reading 8k key. + # +---exec $MYSQL --ssl --ssl-key=$MYSQL_TEST_DIR/std_data/client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/client-cert.pem -e "SHOW STATUS LIKE 'ssl_Cipher'" 2>&1 ++--exec $MYSQL --ssl --ssl-key=$MYSQL_TEST_DIR/std_data/client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/client-cert.pem --ssl-cipher=DHE-RSA-AES256-SHA -e "SHOW STATUS LIKE 'ssl_Cipher'" 2>&1 + + ## This test file is for testing encrypted communication only, not other + ## encryption routines that the SSL library happens to provide! +diff -up mysql-5.5.21/mysql-test/t/ssl_compress.test.cipherspec mysql-5.5.21/mysql-test/t/ssl_compress.test +--- mysql-5.5.21/mysql-test/t/ssl_compress.test.cipherspec 2012-01-31 12:28:15.000000000 +0100 ++++ mysql-5.5.21/mysql-test/t/ssl_compress.test 2012-03-09 14:38:37.085890587 +0100 +@@ -7,7 +7,7 @@ + # Save the initial number of concurrent sessions + --source include/count_sessions.inc + +-connect (ssl_compress_con,localhost,root,,,,,SSL COMPRESS); ++connect (ssl_compress_con,localhost,root,,,,,SSL COMPRESS CIPHER:DHE-RSA-AES256-SHA); + + # Check ssl turned on + SHOW STATUS LIKE 'Ssl_cipher'; +diff -up mysql-5.5.21/mysql-test/t/ssl.test.cipherspec mysql-5.5.21/mysql-test/t/ssl.test +--- mysql-5.5.21/mysql-test/t/ssl.test.cipherspec 2012-01-31 12:28:15.000000000 +0100 ++++ mysql-5.5.21/mysql-test/t/ssl.test 2012-03-09 14:38:37.086890472 +0100 +@@ -6,7 +6,7 @@ + # Save the initial number of concurrent sessions + --source include/count_sessions.inc + +-connect (ssl_con,localhost,root,,,,,SSL); ++connect (ssl_con,localhost,root,,,,,SSL CIPHER:DHE-RSA-AES256-SHA); + + # Check ssl turned on + SHOW STATUS LIKE 'Ssl_cipher'; diff --git a/mysql-file-contents.patch b/mysql-file-contents.patch new file mode 100644 index 0000000..73c680d --- /dev/null +++ b/mysql-file-contents.patch @@ -0,0 +1,27 @@ +Upstream chooses to install INFO_SRC and INFO_BIN into the docs dir, which +breaks at least two packaging commandments, so we put them into $libdir +instead. That means we have to hack the file_contents regression test +to know about this. + +Recommendation they change is at http://bugs.mysql.com/bug.php?id=61425 + + +diff -Naur mysql-5.5.21.orig/mysql-test/t/file_contents.test mysql-5.5.21/mysql-test/t/file_contents.test +--- mysql-5.5.21.orig/mysql-test/t/file_contents.test 2012-01-31 06:28:15.000000000 -0500 ++++ mysql-5.5.21/mysql-test/t/file_contents.test 2012-02-27 17:18:57.716087918 -0500 +@@ -31,6 +31,15 @@ + } else { + # RedHat: version number in directory name + $dir_docs = glob "$dir_docs/MySQL-server*"; ++ ++ # All the above is entirely wacko, because these files are not docs; ++ # they should be kept in libdir instead. mtr does not provide a nice ++ # way to find libdir though, so we have to kluge it like this: ++ if (-d "/usr/lib64/mysql") { ++ $dir_docs = "/usr/lib64/mysql"; ++ } else { ++ $dir_docs = "/usr/lib/mysql"; ++ } + } + } else { + # tar.gz package, Windows, or developer work (in BZR) diff --git a/mysql-plugin-test.patch b/mysql-plugin-test.patch new file mode 100644 index 0000000..51c8328 --- /dev/null +++ b/mysql-plugin-test.patch @@ -0,0 +1,88 @@ +diff -up mysql-5.5.21/mysql-test/t/mysql_plugin-master.opt.plugin mysql-5.5.21/mysql-test/t/mysql_plugin-master.opt +--- mysql-5.5.21/mysql-test/t/mysql_plugin-master.opt.plugin 2012-01-31 12:28:15.000000000 +0100 ++++ mysql-5.5.21/mysql-test/t/mysql_plugin-master.opt 2012-03-14 16:54:19.060951822 +0100 +@@ -1 +1 @@ +---plugin-dir=$DAEMONEXAMPLE_DIR ++--plugin-dir=$MYSQLTEST_VARDIR/plugin +diff -up mysql-5.5.21/mysql-test/t/mysql_plugin.test.plugin mysql-5.5.21/mysql-test/t/mysql_plugin.test +--- mysql-5.5.21/mysql-test/t/mysql_plugin.test.plugin 2012-01-31 12:28:15.000000000 +0100 ++++ mysql-5.5.21/mysql-test/t/mysql_plugin.test 2012-03-14 17:11:40.769295981 +0100 +@@ -25,8 +25,10 @@ + # Add the datadir, basedir, plugin_dir to the bootstrap command + let $MYSQLD_DATADIR= `select @@datadir`; + let $MYSQL_BASEDIR= `select @@basedir`; ++let $MYSQLD_TMP_BASEDIR= $MYSQLTEST_VARDIR/tmp; + let $MYSQL_ERRMSG_BASEDIR=`select @@lc_messages_dir`; + let $PLUGIN_DIR=`select @@plugin_dir`; ++let $PLUGIN_BASEDIR=$DAEMONEXAMPLE_DIR; + + --disable_abort_on_error + +@@ -51,10 +53,11 @@ use File::Basename; + { + print FILE "let \$DAEMONEXAMPLE_DIR= $not_found;\n"; + } +- if ((!-e $plugindir_ini) || (!-r $plugindir_ini)) +- { +- print FILE "let \$PLUGIN_DIR= $not_found;\n"; +- } ++# This test doesn't work because $ENV{PLUGIN_DIR} is empty ++# if ((!-e $plugindir_ini) || (!-r $plugindir_ini)) ++# { ++# print FILE "let \$PLUGIN_DIR= $not_found;\n"; ++# } + close FILE; + EOF + +@@ -66,10 +69,14 @@ remove_file $MYSQL_TMP_DIR/mysqld.inc; + # mysql version, so errmsg.sys will be copied to "basedir/share", we create + # and remove this structure. + +---mkdir $MYSQLD_BASEDIR/share +---mkdir $MYSQLD_BASEDIR/share/mysql +---copy_file $MYSQL_ERRMSG_BASEDIR/english/errmsg.sys $MYSQLD_BASEDIR/share/errmsg.sys +---copy_file $MYSQL_ERRMSG_BASEDIR/english/errmsg.sys $MYSQLD_BASEDIR/share/mysql/errmsg.sys ++--mkdir $MYSQLD_TMP_BASEDIR/share ++--mkdir $MYSQLD_TMP_BASEDIR/share/mysql ++--mkdir $PLUGIN_DIR ++--copy_file $MYSQL_ERRMSG_BASEDIR/english/errmsg.sys $MYSQLD_TMP_BASEDIR/share/errmsg.sys ++--copy_file $MYSQL_ERRMSG_BASEDIR/english/errmsg.sys $MYSQLD_TMP_BASEDIR/share/mysql/errmsg.sys ++--copy_file $PLUGIN_BASEDIR/libdaemon_example.so $PLUGIN_DIR/libdaemon_example.so ++--copy_file $PLUGIN_BASEDIR/daemon_example.ini $PLUGIN_DIR/daemon_example.ini ++ + + # The mysql_plugin tool now accepts --my-print-defaults which points to the + # executable my_print_defaults.exe we can get this path from the variable +@@ -100,7 +107,7 @@ if ($PLUGIN_DIR == '') + + # Build client command for reuse. + +-let $MYSQL_PLUGIN_CMD= $MYSQL_PLUGIN --datadir=$MYSQLD_DATADIR --basedir=$MYSQLD_BASEDIR --plugin-dir=$PLUGIN_DIR --mysqld=$MYSQLD_BASEDIR --my-print-defaults=$MYSQL_MY_PRINT_DEFAULTS_BASEDIR; ++let $MYSQL_PLUGIN_CMD= $MYSQL_PLUGIN --datadir=$MYSQLD_DATADIR --basedir=$MYSQLD_TMP_BASEDIR --plugin-dir=$PLUGIN_DIR --mysqld=$MYSQLD_BASEDIR --my-print-defaults=$MYSQL_MY_PRINT_DEFAULTS_BASEDIR; + + --echo # + --echo # Ensure the plugin isn't loaded. +@@ -202,7 +209,7 @@ EOF + # we must copy the example daemon to a new location renaming it. + + let $DAEMON_RELOAD = lib$DAEMONEXAMPLE; +---copy_file $PLUGIN_DIR/$DAEMONEXAMPLE $PLUGIN_DIR/$DAEMON_RELOAD ++--copy_file $PLUGIN_BASEDIR/$DAEMONEXAMPLE $PLUGIN_DIR/$DAEMON_RELOAD + --copy_file include/libdaemon_example.ini $PLUGIN_DIR/libdaemon_example.ini + + # Now reload it and see that it is a different name. +@@ -395,8 +402,11 @@ EOF + --remove_file $expect_file + + # Cleanup the share folder in the binary path. +---remove_file $MYSQLD_BASEDIR/share/errmsg.sys +---rmdir $MYSQLD_BASEDIR/share/mysql +---rmdir $MYSQLD_BASEDIR/share ++--remove_file $PLUGIN_DIR/daemon_example.ini ++--remove_file $PLUGIN_DIR/libdaemon_example.so ++--rmdir $PLUGIN_DIR ++--remove_file $MYSQLD_TMP_BASEDIR/share/errmsg.sys ++--rmdir $MYSQLD_TMP_BASEDIR/share/mysql ++--rmdir $MYSQLD_TMP_BASEDIR/share + + --enable_abort_on_error diff --git a/mysql-string-overflow.patch b/mysql-string-overflow.patch new file mode 100644 index 0000000..80cf5bc --- /dev/null +++ b/mysql-string-overflow.patch @@ -0,0 +1,52 @@ +These issues were found by Coverity static analysis tool, for more info +see messages by particular fixes (messages belong to 5.1.61). + +Error: BUFFER_SIZE_WARNING: +/builddir/build/BUILD/mysql-5.1.61/sql/sql_prepare.cc:2749: buffer_size_warning: Calling strncpy with a maximum size argument of 512 bytes on destination array "this->stmt->last_error" of size 512 bytes might leave the destination string unterminated. + +diff -up mysql-5.5.21/sql/sql_prepare.cc.coverity mysql-5.5.21/sql/sql_prepare.cc +--- mysql-5.5.21/sql/sql_prepare.cc.coverity 2012-03-13 17:24:40.493658626 +0100 ++++ mysql-5.5.21/sql/sql_prepare.cc 2012-03-13 17:25:14.574338307 +0100 +@@ -2863,7 +2863,7 @@ void mysql_stmt_get_longdata(THD *thd, c + { + stmt->state= Query_arena::STMT_ERROR; + stmt->last_errno= thd->stmt_da->sql_errno(); +- strncpy(stmt->last_error, thd->stmt_da->message(), MYSQL_ERRMSG_SIZE); ++ strncpy(stmt->last_error, thd->stmt_da->message(), sizeof(stmt->last_error)-1); + } + thd->stmt_da= save_stmt_da; + thd->warning_info= save_warinig_info; + + +Error: STRING_OVERFLOW: +/builddir/build/BUILD/mysql-5.1.61/sql/sql_trigger.cc:2194: fixed_size_dest: You might overrun the 512 byte fixed-size string "this->m_parse_error_message" by copying "error_message" without checking the length. +/builddir/build/BUILD/mysql-5.1.61/sql/sql_trigger.cc:2194: parameter_as_source: Note: This defect has an elevated risk because the source argument is a parameter of the current function. + +diff -up mysql-5.5.21/sql/sql_trigger.cc.coverity mysql-5.5.21/sql/sql_trigger.cc +--- mysql-5.5.21/sql/sql_trigger.cc.coverity 2012-03-13 17:25:50.781985493 +0100 ++++ mysql-5.5.21/sql/sql_trigger.cc 2012-03-13 17:27:04.589225626 +0100 +@@ -2260,7 +2260,7 @@ void Table_triggers_list::mark_fields_us + void Table_triggers_list::set_parse_error_message(char *error_message) + { + m_has_unparseable_trigger= true; +- strcpy(m_parse_error_message, error_message); ++ strncpy(m_parse_error_message, error_message, sizeof(m_parse_error_message)-1); + } + + +Error: STRING_OVERFLOW: +/builddir/build/BUILD/mysql-5.1.61/storage/innodb_plugin/handler/ha_innodb.cc:6544: fixed_size_dest: You might overrun the 512 byte fixed-size string "name2" by copying "name" without checking the length. +/builddir/build/BUILD/mysql-5.1.61/storage/innodb_plugin/handler/ha_innodb.cc:6544: parameter_as_source: Note: This defect has an elevated risk because the source argument is a parameter of the current function. + +diff -up mysql-5.5.21/storage/innobase/handler/ha_innodb.cc.coverity mysql-5.5.21/storage/innobase/handler/ha_innodb.cc +--- mysql-5.5.21/storage/innobase/handler/ha_innodb.cc.coverity 2012-03-13 17:28:52.982738150 +0100 ++++ mysql-5.5.21/storage/innobase/handler/ha_innodb.cc 2012-03-13 17:29:14.952427553 +0100 +@@ -6926,7 +6926,7 @@ ha_innobase::create( + DBUG_RETURN(HA_ERR_TO_BIG_ROW); + } + +- strcpy(name2, name); ++ strncpy(name2, name, sizeof(name2)-1); + + normalize_table_name(norm_name, name2); + diff --git a/mysql55.spec b/mysql55.spec index 12cac1e..5e54739 100644 --- a/mysql55.spec +++ b/mysql55.spec @@ -1,5 +1,5 @@ Name: mysql -Version: 5.5.21 +Version: 5.5.22 Release: 1%{?dist} Summary: MySQL client programs and shared libraries @@ -56,6 +56,10 @@ Patch13: mysqld-nowatch.patch Patch14: mysql-va-list.patch Patch15: mysql-netdevname.patch Patch16: mysql-logrotate.patch +Patch17: mysql-plugin-test.patch +Patch18: mysql-cipherspec.patch +Patch19: mysql-file-contents.patch +Patch20: mysql-string-overflow.patch # RC patch for backports Patch21: mysql-readline.patch @@ -241,6 +245,10 @@ rm -f Docs/mysql.info %patch14 -p1 %patch15 -p1 %patch16 -p1 +%patch17 -p1 +%patch18 -p1 +%patch19 -p1 +%patch20 -p1 # Remi specific patches %patch21 -p1 -b .readline @@ -407,6 +415,11 @@ sed -e 's/-lprobes_mysql//' -e 's/-lmysqlclient_r/-lmysqlclient/' \ cp -f mysql_config.tmp ${RPM_BUILD_ROOT}%{_bindir}/mysql_config chmod 755 ${RPM_BUILD_ROOT}%{_bindir}/mysql_config +# install INFO_SRC, INFO_BIN into libdir (upstream thinks these are doc files, +# but that's pretty wacko --- see also mysql-file-contents.patch) +install -m 644 Docs/INFO_SRC ${RPM_BUILD_ROOT}%{_libdir}/mysql/ +install -m 644 Docs/INFO_BIN ${RPM_BUILD_ROOT}%{_libdir}/mysql/ + mkdir -p $RPM_BUILD_ROOT/var/log touch $RPM_BUILD_ROOT/var/log/mysqld.log @@ -688,6 +701,9 @@ fi /usr/libexec/mysqld +%{_libdir}/mysql/INFO_SRC +%{_libdir}/mysql/INFO_BIN + %{_libdir}/mysql/mysqlbug %{_libdir}/mysql/plugin @@ -780,6 +796,28 @@ fi %{_mandir}/man1/mysql_client_test.1* %changelog +* Fri Mar 23 2012 Remi Collet <RPMS@FamilleCollet.com> - 5.5.22-1 +- update to MySQL 5.5.22 Community Server GA + http://dev.mysql.com/doc/refman/5.5/en/news-5-5-22.html +- sync with latest changes in rawhide for 5.5.21 + +* Tue Mar 20 2012 Honza Horak <hhorak@redhat.com> 5.5.21-3 +- Revise mysql_plugin test patch which moves plugin files to + a temporary directory now +Resolves: #789530 + +* Tue Mar 13 2012 Honza Horak <hhorak@redhat.com> 5.5.21-2 +- Fix ssl-related tests to specify expected cipher explicitly +Related: #789600 +- Fix several strcpy calls to check destination size + +* Mon Feb 27 2012 Tom Lane <tgl@redhat.com> 5.5.21-1 +- Update to MySQL 5.5.21, for various fixes described at + http://dev.mysql.com/doc/refman/5.5/en/news-5-5-21.html +- Hack openssl regression test to still work with rawhide's openssl +- Fix assorted failures in post-install regression tests (mysql-test RPM) +Resolves: #789530 + * Tue Feb 21 2012 Remi Collet <RPMS@FamilleCollet.com> - 5.5.21-1 - update to MySQL 5.5.21 Community Server GA http://dev.mysql.com/doc/refman/5.5/en/news-5-5-21.html |