russell@unturf.com
0a580b313d
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com Patches, unit tests, benchmarks, whitepaper, and outreach briefs. Public domain — no copyright claimed. Use freely.
61 lines
3 KiB
ReStructuredText
61 lines
3 KiB
ReStructuredText
MySQL / MariaDB — CWE-407 Analysis
|
||
====================================
|
||
|
||
.. contents:: :local:
|
||
|
||
Overview
|
||
--------
|
||
|
||
MySQL and its fork MariaDB are widely deployed relational databases. The query optimizer
|
||
performs join graph analysis, subquery transformation, and dependency graph construction for
|
||
prepared statements and views.
|
||
|
||
Status: **CLEAN** (scanned 2026-03-23)
|
||
---------------------------------------
|
||
|
||
Scan returned 10 candidates from ``sql/`` and ``storage/innobase/``. All triaged as false
|
||
positives or INFORMATIONAL (bounded, non-hot-path).
|
||
|
||
Triage Notes
|
||
------------
|
||
|
||
+-----------------------------------------------+-----------------------------------+----------+
|
||
| Candidate | Container type | Verdict |
|
||
+===============================================+===================================+==========+
|
||
| ``trivial_receiver.h:38`` HasSeen() | ``mem_root_unordered_set<NodeMap>``| CLEAN |
|
||
+-----------------------------------------------+-----------------------------------+----------+
|
||
| ``window.cc:1004`` ``completed.count(i)`` | ``std::unordered_set<uint>`` | CLEAN |
|
||
+-----------------------------------------------+-----------------------------------+----------+
|
||
| ``hypergraph.cc:32,34,58`` RemoveElement | ``std::vector<T>`` std::find | INFO |
|
||
+-----------------------------------------------+-----------------------------------+----------+
|
||
| ``sql_resolver.cc:9096,9103`` find | ``fields`` list — one-off lookup | FP |
|
||
+-----------------------------------------------+-----------------------------------+----------+
|
||
| ``changestreams/applier_metrics.cc:42`` | micros counter increment | FP |
|
||
+-----------------------------------------------+-----------------------------------+----------+
|
||
|
||
**INFORMATIONAL** — ``hypergraph.cc`` ``RemoveElement``: uses ``std::find`` on a
|
||
``std::vector`` to find and remove an edge from a node's adjacency list during
|
||
``ModifyEdge``. This is O(degree) per call, and ``ModifyEdge`` is called O(edges) times
|
||
during query graph simplification. In the worst case this is O(E×degree) = O(E²/V), but:
|
||
|
||
- The hypergraph optimizer is only invoked when ``optimizer_switch=hypergraph_optimizer=on``
|
||
(default off in current releases)
|
||
- The degree of any node in a join hypergraph is bounded by the number of join predicates
|
||
involving that table, which is small in practice
|
||
|
||
Not a production defect. Recorded as INFORMATIONAL.
|
||
|
||
The TrivialReceiver used for DPhyp subgraph enumeration uses ``mem_root_unordered_set`` — O(1).
|
||
Window function dependency graph uses ``std::unordered_set`` — O(1). Both are correct.
|
||
|
||
Key Finding
|
||
-----------
|
||
|
||
MySQL's hypergraph join optimizer uses ``unordered_set`` for all hot-path visited-state
|
||
tracking. The ``RemoveElement`` vector find is in graph *mutation* (edge removal), not graph
|
||
*traversal* (membership test on visited set). No CWE-407 defect.
|
||
|
||
References
|
||
----------
|
||
|
||
* Scan result: ``tools/scan-results/mysql.txt``
|