MDEV-40867 CONNECT writes unvalidated data from remote filter into fixed-len buffer

[akshatnehra]

Description

This PR fixes MDEV-40867 where TDBTBL::TestFil() in the CONNECT storage engine crashes with SIGSEGV when a TABLE_TYPE=TBL table receives an oversized TABID filter value.

TDBTBL::TestFil() re-parses condition-pushed filter strings using sscanf(fil, "TABID = '%[^']'", tn) where tn is a fixed 192-byte stack buffer (char tn[NAME_LEN]). Since %[^'] is unbounded, a filter value exceeding 192 bytes overflows tn, corrupts the stack, and crashes mysqld.

The fix involves:

1. Adding %192[^'] width specifier to bound writes into tn[NAME_LEN] (192 chars + null = 193 bytes)
2. Adding %7s width specifier to bound writes into op[8] (7 chars + null = 8 bytes)
3. Applying the same bound to the IN (...) loop that parses individual values back into tn

How can this PR be tested?

Run the MTR test:

build/mysql-test/mtr connect.tbl_overflow

Or manually:

INSTALL SONAME 'ha_connect';
CREATE TABLE t1 (a INT NOT NULL) ENGINE=CONNECT;
INSERT INTO t1 VALUES (1);
CREATE TABLE t2 (a INT NOT NULL) ENGINE=CONNECT;
INSERT INTO t2 VALUES (2);
CREATE TABLE total (
  tabname CHAR(8) NOT NULL SPECIAL='TABID',
  ta TINYINT NOT NULL FLAG=1
) ENGINE=CONNECT TABLE_TYPE=TBL TABLE_LIST='t1,t2';

-- These should return empty result, not crash:
SELECT * FROM total WHERE tabname = REPEAT('A', 300);
SELECT * FROM total WHERE tabname IN (REPEAT('B', 300));

Results from my testing

1. Before changes

MariaDB> SELECT * FROM total WHERE tabname = REPEAT('A', 300);
ERROR 2013 (HY000): Lost connection to server during query

MariaDB> SELECT 1;
ERROR 2002 (HY000): Can't connect to local server through socket '/tmp/mysql.sock' (111)

Server crashed with SIGSEGV. Confirmed on MariaDB 10.6.28, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.

2. After changes

MariaDB> SELECT * FROM total WHERE tabname = REPEAT('A', 300);
Empty set (0.00 sec)

MariaDB> SELECT * FROM total WHERE tabname IN (REPEAT('B', 300));
Empty set (0.00 sec)

MariaDB> SELECT * FROM total WHERE tabname NOT IN (REPEAT('C', 300));
+---------+----+
| tabname | ta |
+---------+----+
| t1      |  1 |
| t2      |  2 |
+---------+----+

MariaDB> SELECT * FROM total WHERE tabname = 't1';
+---------+----+
| tabname | ta |
+---------+----+
| t1      |  1 |
+---------+----+

Server stays alive. Normal TABID filtering works correctly. Existing connect.tbl MTR test passes with no regression.

Basing the PR against the correct MariaDB version

• This is a bug fix and the PR is based against the oldest affected MariaDB version (10.6) branch.

PR quality check

• I have checked the CODING_STANDARDS.md file and my PR conforms to this where appropriate.
• For any trivial modifications to the PR, I am fine with the reviewer making the changes themselves.

[grooverdan]

10.6 has had its last release, so can this be rebased to 10.11 please.

[grooverdan]

A description as to why 7 would be useful.

[akshatnehra]

It is same as previously hardcoded value, no change

[CLAassistant]

All committers have signed the CLA.

[gkodinov]

Thank you for your contribution! This is a preliminary review.

LGTM. Please stand by for the final reviewer.

[gkodinov]

FYI: According to our development cycle we work on bugs In the following periods 15 Mar-30 Apr, 15 Jun-30 Jul, 15 Sep-30 Oct and 15 Dec-31 Jan. So, please, expect to get a review somewhere between these two dates and the goal is to have your PR merged before the second date

[Copilot]

Pull request overview

This PR addresses MDEV-40867 in the CONNECT storage engine by preventing stack buffer overflows in TDBTBL::TestFil() when re-parsing pushed-down TABID filters containing oversized values, and adds an MTR regression test to ensure the server no longer crashes.

Changes:

• Bound sscanf reads for the TABID operator token and string value parsing to prevent writing past fixed-length stack buffers.
• Applied the same bounded parsing for values extracted from IN (...) filters.
• Extended the existing connect.tbl MTR test coverage to include oversized TABID filter inputs.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
storage/connect/tabtbl.cpp	Adds width limits to sscanf parsing in TDBTBL::TestFil() to prevent buffer overflows.
storage/connect/mysql-test/connect/t/tbl.test	Adds regression queries to verify oversized TABID filters don’t crash and behave as expected.
storage/connect/mysql-test/connect/r/tbl.result	Updates expected output for the new regression coverage.

Suppressed comments (1)

storage/connect/mysql-test/connect/t/tbl.test:89

• The trailing marker End of 10.11 tests is misleading in a generic MTR test file and looks like a copy/paste artifact. Consider making this version-neutral to avoid confusion when the test is run on other branches/versions.

--echo # End of 10.11 tests

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.