pingcap / pingcap/tidb

uint32 connection id cannot be parsed for `mariadb-connector-j`

Open
#61,259 5 comments 0 reactions 0 assignees View on GitHub
sig/sql-infra type/bug
Dominant language
Go
Stars
40.5k
Forks
6.2k
PR merge metrics
PR metrics pending

Description

## Bug Report

From the [doc of MySQL](https://dev.mysql.com/doc/dev/mysql-server/latest/page_protocol_connection_phase_packets_protocol_handshake_v10.html), the thread(connection) is [fixed length integer](https://dev.mysql.com/doc/dev/mysql-server/latest/page_protocol_basic_dt_integers.html#sect_protocol_basic_dt_int_fixed), which is an unsigned int32.

But in `mariadb-connector-j`'s implementation, the thread id is parsed as a Java's int, which is a signed int32.

```java
// https://github.com/mariadb-corporation/mariadb-connector-j/blob/3a78c35ca1997069ad6e792d3513ac1c05addd15/src/main/java/org/mariadb/jdbc/message/server/InitialHandshakePacket.java#L73
public static InitialHandshakePacket decode(ReadableByteBuf reader) {
...
long threadId = reader.readInt();
...
}

// https://github.com/mariadb-corporation/mariadb-connector-j/blob/3a78c35ca1997069ad6e792d3513ac1c05addd15/src/main/java/org/mariadb/jdbc/client/impl/StandardReadableByteBuf.java#L219-L224
public int readInt() {
return ((buf[pos++] & 0xff)
+ ((buf[pos++] & 0xff) << 8)
+ ((buf[pos++] & 0xff) << 16)
+ ((buf[pos++] & 0xff) << 24));
}
```

Unluckily, TiDB's thread id is not allocated from 1, it contains some extra information, so that it's very likely to cause an overflow in `mariadb-connector-j`.

### 1. Minimal reproduce step (Required)

Run the following test with `mariadb-java-client`.

pom.xml
```xml

org.mariadb.jdbc
mariadb-java-client
3.5.3

```

```java
package com.pingcap;

import java.sql.*;

public class JDBCExample
{
public static void main(String[] args) {
try {
Class.forName("org.mariadb.jdbc.Driver");
} catch (ClassNotFoundException e) {
System.err.println("MySQL JDBC Driver not found.");
e.printStackTrace();
return;
}

try (
Connection connection = DriverManager.getConnection("jdbc:mariadb://127.0.0.1:4000/test?user=root&password=&useSSL=false");
) {
connection.setAutoCommit(false);
Statement statement = connection.createStatement();
statement.setQueryTimeout(1);
statement.executeQuery("select sleep(2)");
} catch (SQLException e) {
System.err.println("SQL Exception: " + e.getMessage());
e.printStackTrace();
}
}
}
```

You can also download [issue-61259.tar.gz](https://github.com/user-attachments/files/20380257/issue-61259.tar.gz).

```bash
tar xzf issue-61259.tar.gz
cd issue-61259
make
```

### 2. What did you expect to see? (Required)

The sleep is killed.

### 3. What did you see instead (Required)

The sleep is probably not killed.

```log
[2025/05/22 13:56:29.797 +09:00] [INFO] [session.go:4191] [GENERAL_LOG] [conn=2166358026] [session_alias=] [user=root@127.0.0.1] [schemaVersion=55] [txnStartTS=0] [forUpdateTS=0] [isReadConsistency=false] [currentDB=test] [isPessimistic=true] [sessionTxnMode=PESSIMISTIC] [sql="select sleep(2)"]
...
[2025/05/22 13:56:30.798 +09:00] [INFO] [conn.go:1190] ["command dispatched failed"] [conn=2166358028] [session_alias=] [connInfo="id:2166358028, addr:127.0.0.1:43254 status:10, collation:utf8mb4_bin, user:root"] [command=Query] [status="inTxn:0, autocommit:1"] [sql="KILL QUERY -2128609270"] [txn_mode=PESSIMISTIC] [timestamp=0] [err="[parser:1064]You have an error in your SQL syntax; check the manual that corresponds to your TiDB version for the right syntax to use line 1 column 12 near \"-2128609270\" "]
```

### 4. What is your TiDB version? (Required)

nightly

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.