This is an automated email from the ASF dual-hosted git repository.
Mryange pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/doris.git
The following commit(s) were added to refs/heads/master by this push:
new 2289f4626d5 [fix](fe) Fix MySQL packet truncation over TLS (#68703)
2289f4626d5 is described below
commit 2289f4626d589fc1c7f3c300cc415db5dcfb5f90
Author: Mryange <[email protected]>
AuthorDate: Mon Oct 12 11:02:17 2026 +0800
[fix](fe) Fix MySQL packet truncation over TLS (#68703)
### What problem does this PR solve?
Issue Number: N/A
Problem Summary:
MySQL queries sent over TLS can fail with parser errors near a TLS
record boundary. Root cause: after removing the MySQL header with
`compact()`, the receive loop compares the declared payload length
against the buffer limit, which becomes its capacity, instead of the
number of decrypted bytes received. If the payload length falls between
the current position and capacity, the loop skips a required TLS record
and exposes unreceived bytes to the parser.
Compare against `result.position()` so the receive loop collects the
complete payload before processing it.
### Release note
Fix SQL truncation and parser errors when a MySQL query spans TLS
records near the receive-buffer boundary.
### Check List (For Author)
- Test:
- [x] Manual test
- Built FE with `./build.sh --fe -j48`; Checkstyle passed.
- Used a PyMySQL TLS connection to send a COM_QUERY with a 16,380-byte
payload. Splitting the 16,384-byte MySQL packet after byte 16,380 or
16,383 produced parser errors before the fix; the same requests produced
a result-set response after rebuilding and restarting FE with the fix. A
complete 16,384-byte write also succeeded.
- Repeated with 16,400-byte and 17,000-byte payloads split at bytes
16,380, 16,383, and 16,384; all produced result-set responses after the
fix.
- `git diff --check` passed. Automated unit and regression tests were
not run.
- Behavior changed:
- [x] Yes. Read all TLS records needed to complete the MySQL payload.
- Does this need documentation?
- [x] No.
### Check List (For Reviewer who merge this PR)
- [ ] Confirm the release note
- [ ] Confirm test cases
- [ ] Confirm document
- [ ] Add branch pick label
---
fe/fe-core/src/main/java/org/apache/doris/mysql/MysqlChannel.java | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fe/fe-core/src/main/java/org/apache/doris/mysql/MysqlChannel.java
b/fe/fe-core/src/main/java/org/apache/doris/mysql/MysqlChannel.java
index 58f0e93791b..033dafae2b2 100644
--- a/fe/fe-core/src/main/java/org/apache/doris/mysql/MysqlChannel.java
+++ b/fe/fe-core/src/main/java/org/apache/doris/mysql/MysqlChannel.java
@@ -391,7 +391,7 @@ public class MysqlChannel implements BytesChannel {
result.compact();
// when encounter large sql query, one mysql packet will be
packed as multiple ssl packets.
// we need to read all ssl packets to combine the complete
mysql packet.
- while (mysqlPacketLength > result.limit()) {
+ while (mysqlPacketLength > result.position()) {
sslHeaderByteBuffer.clear();
readLen = readAll(sslHeaderByteBuffer, true);
if (readLen != SSL_PACKET_HEADER_LEN) {
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
