MDEV-37316

[ParadoxV5]

• Resolves MDEV-37316

Just a draft/preview that also serves as CI upload and backup; not final yet, not even close…

---

What problem is the patch trying to solve?
If some output changed that is not visible in a test case, what was it looking like before the change and how it's looking with this patch applied?
Do you think this patch might introduce side-effects in other parts of the server?
Anything from release notes?

[gemini-code-assist]

Code Review

This pull request introduces the Remote_event_stream class to encapsulate MariaDB Connector/C handles, refactoring the replication slave I/O thread and semi-sync logic to use this new abstraction instead of raw MYSQL pointers. Feedback highlights critical bugs, including a missing error check for cli_safe_read that could cause memory corruption, a buffer over-read vulnerability in semisync_ack, and a 1-byte offset error in read_event that breaks event parsing. Other recommendations include ensuring my_global.h is the first include, removing a redundant vio_close call, and using const char * in Connection_options for better ownership semantics.

[gemini-code-assist]

The return value of cli_safe_read is not checked for errors. If it returns (unsigned long)-1 (the value of packet_error), strlen will be cast to a very large size_t, resulting in an invalid string_view. This will cause next().size() to be non-zero, bypassing error checks in the caller and potentially leading to memory corruption.

  unsigned long len= cli_safe_read(connector);
  if (unlikely(len == (unsigned long)-1))
    return {};
  return {connector->net.read_pos, static_cast<size_t>(len)};

[ParadoxV5]

packet_error is 0 in libmysql.

[gemini-code-assist]

There is a buffer over-read risk in semisync_ack. The payload buffer has a fixed size based on FN_REFLEN, but my_net_write uses log_name.size() + 1 as the length without validation. If log_name.size() exceeds FN_REFLEN, my_net_write will read past the end of the payload array. Also, std::string_view::copy does not null-terminate.

  size_t copied= log_name.copy(&(payload[HEAD_SIZE]), sizeof(payload) - HEAD_SIZE - 1);
  payload[HEAD_SIZE + copied]= '\0';
  NET *net= &connector->net;
  //@deprecated: not required in Connector/C
  net->pkt_nr_can_be_reset= true;
  // Connector/C might not require resetting; better be safe until confirmed.
  net_clear(net, false);
  return my_net_write(net, reinterpret_cast<const unsigned char *>(payload),
    HEAD_SIZE + copied + 1) || net_flush(net);

[ParadoxV5]

If log_name.size() exceeds FN_REFLEN, my_net_write will read past the end of the payload array.

It will not de facto.

Also, std::string_view::copy does not null-terminate.

The array initialization does.

[gemini-code-assist]

The read_event function now returns the entire packet including the MySQL protocol status byte (at index 0). However, the rest of the replication logic in handle_slave_io expects event_buf and event_len to represent only the event data (excluding the status byte). Returning the full packet here causes a 1-byte offset error in event parsing.

  DBUG_RETURN(packet.substr(1));