[debian-mysql] Bug#1008629: mariadb-server-core-10.3: MDEV-27937 no results on large prepared statement parameter list

[Dominic Benson]

Package: mariadb-server-core-10.3
Version: 1:10.3.34-0+deb10u1
Severity: important
Tags: patch upstream

Dear Maintainer,

Following update from 1:10.3.31-0+deb10u1 -> 1:10.3.34-0+deb10u1, prepared statements with > 1,000
parameters stop returning results.

Previously a prepared statement like "SELECT col FROM table WHERE id IN (?,?,?,....,?)" would return matches with
at least 2k parameters in the list. Following the update, it fails to return any results with more than 1k. 

This matches the bug described upstream in https://jira.mariadb.org/browse/MDEV-27937

The workaround is to set in_predicate_conversion_threshold to a value > 1000, but this requires intervention on
applications, and just adjusts the threshold of failure.

The proper fix is set to be included in 10.3.35, but as it causes quite severe brokenness, I think 
it would be appropriate to backport to 10.3.34 rather than waiting for the upstream release

The upstream fix appears to be: https://github.com/MariaDB/server/commit/e048289e557315b068a15083267329c443faadd3

The same upstream bug also affects 10.5.15 and 10.6.7 so equivalent updates to those packages for bullseye/bookworm/sid
would be indicated

-- System Information:
Debian Release: 10.12
  APT prefers oldstable-updates
  APT policy: (500, 'oldstable-updates'), (500, 'oldstable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.19.0-18-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages mariadb-server-core-10.3 depends on:
ii  libaio1         0.3.112-3
ii  libc6           2.28-10+deb10u1
ii  libgnutls30     3.6.7-4+deb10u7
ii  liblz4-1        1.8.3-1+deb10u1
ii  libpcre3        2:8.39-12
ii  libsnappy1v5    1.1.7-1
ii  libstdc++6      8.3.0-6
ii  libsystemd0     241-7~deb10u8
ii  mariadb-common  1:10.3.34-0+deb10u1
ii  zlib1g          1:1.2.11.dfsg-1

mariadb-server-core-10.3 recommends no packages.

mariadb-server-core-10.3 suggests no packages.

-- no debconf information