MySQL 8.0.46 Group Replication still ships pre-Bug#38021787 inet_ntop length and aborts at runtime

Start in plugin/group_replication/libmysqlgcs/src/bindings/xcom/gcs_xcom_networking.cc and compare sock_descriptor_to_string with trunk commit 9f40f3e081ee528bd0c9481139efddcdcea7925f. Verify the maintained 8.0 branch contains the Bug#38021787 correction, then exercise the Group Replication IP allowlist rejection path on a fortify-enabled Linux build. Done means rejected IPv4 and IPv6 connections no longer abort mysqld.

Summary

MySQL 8.0.46 still ships the pre-Bug#38021787 Group Replication code that passes a destination length larger than the actual inet_ntop buffer. On a fortify-enabled Linux runtime, an incoming connection rejected by the Group Replication IP allowlist can abort mysqld with signal 6.

The fix is already present on MySQL trunk in commit 9f40f3e081ee528bd0c9481139efddcdcea7925f, but it is absent from the official mysql-8.0.46 tag (0a7df2e4693d8f10901a26034ae6257699356e30). Please backport the fix to the maintained 8.0 release line.

Affected source

File:

plugin/group_replication/libmysqlgcs/src/bindings/xcom/gcs_xcom_networking.cc

In sock_descriptor_to_string, the 8.0.46 source declares:

char saddr[INET6_ADDRSTRLEN];

but calls inet_ntop with sizeof(sockaddr_storage) as the destination size. On this platform those sizes are 46 and 128 bytes, respectively.

Bug#38021787 corrected the call to use the actual size of saddr.

Runtime reproduction

Environment:

• official MySQL 8.0.46 Group Replication image
• Linux amd64 with fortify enabled
• Group Replication IP allowlist configured to reject an incoming peer connection

Observed stack:

__inet_ntop_chk
__chk_fail
sock_descriptor_to_string
Gcs_ip_allowlist::shall_block
cb_xcom_socket_accept
xcom_tcp_server_startup

The server logs *** buffer overflow detected *** and terminates with signal 6.

A minimal control compiled from the exact 8.0.46 call pattern terminates with rc 134. Changing only the length argument to sizeof(saddr), as in Bug#38021787, makes both IPv4 and IPv6 controls exit successfully.

Expected behavior

Rejecting a connection through the Group Replication IP allowlist must not terminate mysqld. The maintained MySQL 8.0 release should include the already-accepted Bug#38021787 fix.

References

• Official affected tag: mysql-8.0.46, commit 0a7df2e4693d8f10901a26034ae6257699356e30
• Existing upstream fix: https://github.com/mysql/mysql-server/commit/9f40f3e081ee528bd0c9481139efddcdcea7925f
• Existing internal bug identifier from that commit: Bug#38021787