Merging upstream version 1:11.4.2.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

14 files changed, 309 insertions, 173 deletions

diff --git a/include/mysql/client_plugin.h b/include/mysql/client_plugin.h
index 990cecc9..404c3f1e 100644
--- a/include/mysql/client_plugin.h
+++ b/include/mysql/client_plugin.h
@@ -56,7 +56,7 @@
 #define MYSQL_CLIENT_reserved2               1
 #define MYSQL_CLIENT_AUTHENTICATION_PLUGIN   2
 
-#define MYSQL_CLIENT_AUTHENTICATION_PLUGIN_INTERFACE_VERSION  0x0100
+#define MYSQL_CLIENT_AUTHENTICATION_PLUGIN_INTERFACE_VERSION  0x0101
 
 #define MYSQL_CLIENT_MAX_PLUGINS             3
 
@@ -96,6 +96,7 @@ struct st_mysql_client_plugin_AUTHENTICATION
 {
   MYSQL_CLIENT_PLUGIN_HEADER
   int (*authenticate_user)(MYSQL_PLUGIN_VIO *vio, struct st_mysql *mysql);
+  int (*hash_password_bin)(struct st_mysql *mysql, unsigned char *hash, size_t *hash_length);
 };
 
 #include <mysql/auth_dialog_client.h>
diff --git a/include/mysql/client_plugin.h.pp b/include/mysql/client_plugin.h.pp
index b6ba9cf0..ff35364b 100644
--- a/include/mysql/client_plugin.h.pp
+++ b/include/mysql/client_plugin.h.pp
@@ -22,6 +22,7 @@ struct st_mysql_client_plugin_AUTHENTICATION
 {
   int type; unsigned int interface_version; const char *name; const char *author; const char *desc; unsigned int version[3]; const char *license; void *mysql_api; int (*init)(char *, size_t, int, va_list); int (*deinit)(); int (*options)(const char *option, const void *);
   int (*authenticate_user)(MYSQL_PLUGIN_VIO *vio, struct st_mysql *mysql);
+  int (*hash_password_bin)(struct st_mysql *mysql, unsigned char *hash, size_t *hash_length);
 };
 struct st_mysql;
 typedef char *(*mysql_authentication_dialog_ask_t)(struct st_mysql *mysql,
diff --git a/include/mysql/plugin_audit.h.pp b/include/mysql/plugin_audit.h.pp
index 57ba61d3..e13acc71 100644
--- a/include/mysql/plugin_audit.h.pp
+++ b/include/mysql/plugin_audit.h.pp
@@ -57,10 +57,17 @@ static inline int encryption_crypt(const unsigned char* src, unsigned int slen,
 {
   void *ctx= alloca(encryption_handler.encryption_ctx_size_func((key_id),(key_version)));
   int res1, res2;
-  unsigned int d1, d2;
+  unsigned int d1, d2= *dlen;
+  assert(*dlen >= slen);
+  assert((dst[*dlen - 1]= 1));
+  if (src < dst)
+    assert(src + slen <= dst);
+  else
+    assert(dst + *dlen <= src);
   if ((res1= encryption_handler.encryption_ctx_init_func((ctx),(key),(klen),(iv),(ivlen),(flags),(key_id),(key_version))))
     return res1;
   res1= encryption_handler.encryption_ctx_update_func((ctx),(src),(slen),(dst),(&d1));
+  d2-= d1;
   res2= encryption_handler.encryption_ctx_finish_func((ctx),(dst + d1),(&d2));
   *dlen= d1 + d2;
   return res1 ? res1 : res2;
@@ -294,35 +301,39 @@ void my_sha512_input(void *context, const unsigned char *buf, size_t len);
 void my_sha512_result(void *context, unsigned char *digest);
 }
 extern "C" {
-struct st_mysql_lex_string
-{
-  char *str;
-  size_t length;
-};
-typedef struct st_mysql_lex_string MYSQL_LEX_STRING;
 struct st_mysql_const_lex_string
 {
   const char *str;
   size_t length;
 };
 typedef struct st_mysql_const_lex_string MYSQL_CONST_LEX_STRING;
+struct st_mysql_lex_string
+{
+  char *str;
+  size_t length;
+  operator struct st_mysql_const_lex_string() const
+  {
+    return {str, length};
+  }
+};
+typedef struct st_mysql_lex_string MYSQL_LEX_STRING;
 extern struct thd_alloc_service_st {
-  void *(*thd_alloc_func)(THD*, size_t);
-  void *(*thd_calloc_func)(THD*, size_t);
-  char *(*thd_strdup_func)(THD*, const char *);
-  char *(*thd_strmake_func)(THD*, const char *, size_t);
-  void *(*thd_memdup_func)(THD*, const void*, size_t);
-  MYSQL_CONST_LEX_STRING *(*thd_make_lex_string_func)(THD*,
+  void *(*thd_alloc_func)(const THD*, size_t);
+  void *(*thd_calloc_func)(const THD*, size_t);
+  char *(*thd_strdup_func)(const THD*, const char *);
+  char *(*thd_strmake_func)(const THD*, const char *, size_t);
+  void *(*thd_memdup_func)(const THD*, const void*, size_t);
+  MYSQL_CONST_LEX_STRING *(*thd_make_lex_string_func)(const THD*,
                                         MYSQL_CONST_LEX_STRING *,
                                         const char *, size_t, int);
 } *thd_alloc_service;
-void *thd_alloc(THD* thd, size_t size);
-void *thd_calloc(THD* thd, size_t size);
-char *thd_strdup(THD* thd, const char *str);
-char *thd_strmake(THD* thd, const char *str, size_t size);
-void *thd_memdup(THD* thd, const void* str, size_t size);
+void *thd_alloc(const THD* thd, size_t size);
+void *thd_calloc(const THD* thd, size_t size);
+char *thd_strdup(const THD* thd, const char *str);
+char *thd_strmake(const THD* thd, const char *str, size_t size);
+void *thd_memdup(const THD* thd, const void* str, size_t size);
 MYSQL_CONST_LEX_STRING
-*thd_make_lex_string(THD* thd, MYSQL_CONST_LEX_STRING *lex_str,
+*thd_make_lex_string(const THD* thd, MYSQL_CONST_LEX_STRING *lex_str,
                      const char *str, size_t size,
                      int allocate_lex_string);
 }
@@ -487,9 +498,12 @@ extern struct sql_service_st {
   int (STDCALL *mysql_set_character_set_func)(MYSQL *mysql, const char *cs_name);
   unsigned int (STDCALL *mysql_num_fields_func)(MYSQL_RES *res);
   int (STDCALL *mysql_select_db_func)(MYSQL *mysql, const char *db);
+  MYSQL_RES *(STDCALL *mysql_use_result_func)(MYSQL *mysql);
+  MYSQL_FIELD *(STDCALL *mysql_fetch_fields_func)(MYSQL_RES *res);
+  unsigned long (STDCALL *mysql_real_escape_string_func)(MYSQL *mysql, char *to,
+                                        const char *from, unsigned long length);
   my_bool (STDCALL *mysql_ssl_set_func)(MYSQL *mysql, const char *key,
-                                        const char *cert, const char *ca,
-                                        const char *capath, const char *cipher);
+      const char *cert, const char *ca, const char *capath, const char *cipher);
 } *sql_service;
 MYSQL *mysql_real_connect_local(MYSQL *mysql);
 }
diff --git a/include/mysql/plugin_auth.h.pp b/include/mysql/plugin_auth.h.pp
index 15e4c0cd..442eeb9c 100644
--- a/include/mysql/plugin_auth.h.pp
+++ b/include/mysql/plugin_auth.h.pp
@@ -57,10 +57,17 @@ static inline int encryption_crypt(const unsigned char* src, unsigned int slen,
 {
   void *ctx= alloca(encryption_handler.encryption_ctx_size_func((key_id),(key_version)));
   int res1, res2;
-  unsigned int d1, d2;
+  unsigned int d1, d2= *dlen;
+  assert(*dlen >= slen);
+  assert((dst[*dlen - 1]= 1));
+  if (src < dst)
+    assert(src + slen <= dst);
+  else
+    assert(dst + *dlen <= src);
   if ((res1= encryption_handler.encryption_ctx_init_func((ctx),(key),(klen),(iv),(ivlen),(flags),(key_id),(key_version))))
     return res1;
   res1= encryption_handler.encryption_ctx_update_func((ctx),(src),(slen),(dst),(&d1));
+  d2-= d1;
   res2= encryption_handler.encryption_ctx_finish_func((ctx),(dst + d1),(&d2));
   *dlen= d1 + d2;
   return res1 ? res1 : res2;
@@ -294,35 +301,39 @@ void my_sha512_input(void *context, const unsigned char *buf, size_t len);
 void my_sha512_result(void *context, unsigned char *digest);
 }
 extern "C" {
-struct st_mysql_lex_string
-{
-  char *str;
-  size_t length;
-};
-typedef struct st_mysql_lex_string MYSQL_LEX_STRING;
 struct st_mysql_const_lex_string
 {
   const char *str;
   size_t length;
 };
 typedef struct st_mysql_const_lex_string MYSQL_CONST_LEX_STRING;
+struct st_mysql_lex_string
+{
+  char *str;
+  size_t length;
+  operator struct st_mysql_const_lex_string() const
+  {
+    return {str, length};
+  }
+};
+typedef struct st_mysql_lex_string MYSQL_LEX_STRING;
 extern struct thd_alloc_service_st {
-  void *(*thd_alloc_func)(THD*, size_t);
-  void *(*thd_calloc_func)(THD*, size_t);
-  char *(*thd_strdup_func)(THD*, const char *);
-  char *(*thd_strmake_func)(THD*, const char *, size_t);
-  void *(*thd_memdup_func)(THD*, const void*, size_t);
-  MYSQL_CONST_LEX_STRING *(*thd_make_lex_string_func)(THD*,
+  void *(*thd_alloc_func)(const THD*, size_t);
+  void *(*thd_calloc_func)(const THD*, size_t);
+  char *(*thd_strdup_func)(const THD*, const char *);
+  char *(*thd_strmake_func)(const THD*, const char *, size_t);
+  void *(*thd_memdup_func)(const THD*, const void*, size_t);
+  MYSQL_CONST_LEX_STRING *(*thd_make_lex_string_func)(const THD*,
                                         MYSQL_CONST_LEX_STRING *,
                                         const char *, size_t, int);
 } *thd_alloc_service;
-void *thd_alloc(THD* thd, size_t size);
-void *thd_calloc(THD* thd, size_t size);
-char *thd_strdup(THD* thd, const char *str);
-char *thd_strmake(THD* thd, const char *str, size_t size);
-void *thd_memdup(THD* thd, const void* str, size_t size);
+void *thd_alloc(const THD* thd, size_t size);
+void *thd_calloc(const THD* thd, size_t size);
+char *thd_strdup(const THD* thd, const char *str);
+char *thd_strmake(const THD* thd, const char *str, size_t size);
+void *thd_memdup(const THD* thd, const void* str, size_t size);
 MYSQL_CONST_LEX_STRING
-*thd_make_lex_string(THD* thd, MYSQL_CONST_LEX_STRING *lex_str,
+*thd_make_lex_string(const THD* thd, MYSQL_CONST_LEX_STRING *lex_str,
                      const char *str, size_t size,
                      int allocate_lex_string);
 }
@@ -487,9 +498,12 @@ extern struct sql_service_st {
   int (STDCALL *mysql_set_character_set_func)(MYSQL *mysql, const char *cs_name);
   unsigned int (STDCALL *mysql_num_fields_func)(MYSQL_RES *res);
   int (STDCALL *mysql_select_db_func)(MYSQL *mysql, const char *db);
+  MYSQL_RES *(STDCALL *mysql_use_result_func)(MYSQL *mysql);
+  MYSQL_FIELD *(STDCALL *mysql_fetch_fields_func)(MYSQL_RES *res);
+  unsigned long (STDCALL *mysql_real_escape_string_func)(MYSQL *mysql, char *to,
+                                        const char *from, unsigned long length);
   my_bool (STDCALL *mysql_ssl_set_func)(MYSQL *mysql, const char *key,
-                                        const char *cert, const char *ca,
-                                        const char *capath, const char *cipher);
+      const char *cert, const char *ca, const char *capath, const char *cipher);
 } *sql_service;
 MYSQL *mysql_real_connect_local(MYSQL *mysql);
 }
diff --git a/include/mysql/plugin_auth_common.h b/include/mysql/plugin_auth_common.h
index 8edd7128..cba0257f 100644
--- a/include/mysql/plugin_auth_common.h
+++ b/include/mysql/plugin_auth_common.h
@@ -85,6 +85,8 @@
   authentication protocol is not known in advance, and the client plugin
   needs to read one packet more to determine if the authentication is finished
   or not.
+
+  Server plugins should not return this value.
 */
 #define CR_OK_HANDSHAKE_COMPLETE -2
 
diff --git a/include/mysql/plugin_data_type.h.pp b/include/mysql/plugin_data_type.h.pp
index 7938bf3c..5d5812e5 100644
--- a/include/mysql/plugin_data_type.h.pp
+++ b/include/mysql/plugin_data_type.h.pp
@@ -57,10 +57,17 @@ static inline int encryption_crypt(const unsigned char* src, unsigned int slen,
 {
   void *ctx= alloca(encryption_handler.encryption_ctx_size_func((key_id),(key_version)));
   int res1, res2;
-  unsigned int d1, d2;
+  unsigned int d1, d2= *dlen;
+  assert(*dlen >= slen);
+  assert((dst[*dlen - 1]= 1));
+  if (src < dst)
+    assert(src + slen <= dst);
+  else
+    assert(dst + *dlen <= src);
   if ((res1= encryption_handler.encryption_ctx_init_func((ctx),(key),(klen),(iv),(ivlen),(flags),(key_id),(key_version))))
     return res1;
   res1= encryption_handler.encryption_ctx_update_func((ctx),(src),(slen),(dst),(&d1));
+  d2-= d1;
   res2= encryption_handler.encryption_ctx_finish_func((ctx),(dst + d1),(&d2));
   *dlen= d1 + d2;
   return res1 ? res1 : res2;
@@ -294,35 +301,39 @@ void my_sha512_input(void *context, const unsigned char *buf, size_t len);
 void my_sha512_result(void *context, unsigned char *digest);
 }
 extern "C" {
-struct st_mysql_lex_string
-{
-  char *str;
-  size_t length;
-};
-typedef struct st_mysql_lex_string MYSQL_LEX_STRING;
 struct st_mysql_const_lex_string
 {
   const char *str;
   size_t length;
 };
 typedef struct st_mysql_const_lex_string MYSQL_CONST_LEX_STRING;
+struct st_mysql_lex_string
+{
+  char *str;
+  size_t length;
+  operator struct st_mysql_const_lex_string() const
+  {
+    return {str, length};
+  }
+};
+typedef struct st_mysql_lex_string MYSQL_LEX_STRING;
 extern struct thd_alloc_service_st {
-  void *(*thd_alloc_func)(THD*, size_t);
-  void *(*thd_calloc_func)(THD*, size_t);
-  char *(*thd_strdup_func)(THD*, const char *);
-  char *(*thd_strmake_func)(THD*, const char *, size_t);
-  void *(*thd_memdup_func)(THD*, const void*, size_t);
-  MYSQL_CONST_LEX_STRING *(*thd_make_lex_string_func)(THD*,
+  void *(*thd_alloc_func)(const THD*, size_t);
+  void *(*thd_calloc_func)(const THD*, size_t);
+  char *(*thd_strdup_func)(const THD*, const char *);
+  char *(*thd_strmake_func)(const THD*, const char *, size_t);
+  void *(*thd_memdup_func)(const THD*, const void*, size_t);
+  MYSQL_CONST_LEX_STRING *(*thd_make_lex_string_func)(const THD*,
                                         MYSQL_CONST_LEX_STRING *,
                                         const char *, size_t, int);
 } *thd_alloc_service;
-void *thd_alloc(THD* thd, size_t size);
-void *thd_calloc(THD* thd, size_t size);
-char *thd_strdup(THD* thd, const char *str);
-char *thd_strmake(THD* thd, const char *str, size_t size);
-void *thd_memdup(THD* thd, const void* str, size_t size);
+void *thd_alloc(const THD* thd, size_t size);
+void *thd_calloc(const THD* thd, size_t size);
+char *thd_strdup(const THD* thd, const char *str);
+char *thd_strmake(const THD* thd, const char *str, size_t size);
+void *thd_memdup(const THD* thd, const void* str, size_t size);
 MYSQL_CONST_LEX_STRING
-*thd_make_lex_string(THD* thd, MYSQL_CONST_LEX_STRING *lex_str,
+*thd_make_lex_string(const THD* thd, MYSQL_CONST_LEX_STRING *lex_str,
                      const char *str, size_t size,
                      int allocate_lex_string);
 }
@@ -487,9 +498,12 @@ extern struct sql_service_st {
   int (STDCALL *mysql_set_character_set_func)(MYSQL *mysql, const char *cs_name);
   unsigned int (STDCALL *mysql_num_fields_func)(MYSQL_RES *res);
   int (STDCALL *mysql_select_db_func)(MYSQL *mysql, const char *db);
+  MYSQL_RES *(STDCALL *mysql_use_result_func)(MYSQL *mysql);
+  MYSQL_FIELD *(STDCALL *mysql_fetch_fields_func)(MYSQL_RES *res);
+  unsigned long (STDCALL *mysql_real_escape_string_func)(MYSQL *mysql, char *to,
+                                        const char *from, unsigned long length);
   my_bool (STDCALL *mysql_ssl_set_func)(MYSQL *mysql, const char *key,
-                                        const char *cert, const char *ca,
-                                        const char *capath, const char *cipher);
+      const char *cert, const char *ca, const char *capath, const char *cipher);
 } *sql_service;
 MYSQL *mysql_real_connect_local(MYSQL *mysql);
 }
diff --git a/include/mysql/plugin_encryption.h b/include/mysql/plugin_encryption.h
index 3c574aa4..a036e221 100644
--- a/include/mysql/plugin_encryption.h
+++ b/include/mysql/plugin_encryption.h
@@ -96,8 +96,11 @@ struct st_mariadb_encryption
   /**
     processes (encrypts or decrypts) a chunk of data
 
-    writes the output to th dst buffer. note that it might write
+    writes the output to the dst buffer. note that it might write
     more bytes that were in the input. or less. or none at all.
+
+    dlen points to the starting lenght of the output buffer. Upon return, it
+    should be set to the number of bytes written.
   */
   int (*crypt_ctx_update)(void *ctx, const unsigned char* src, unsigned int slen,
                           unsigned char* dst, unsigned int* dlen);
@@ -123,4 +126,3 @@ struct st_mariadb_encryption
 }
 #endif
 #endif
-
diff --git a/include/mysql/plugin_encryption.h.pp b/include/mysql/plugin_encryption.h.pp
index 97191c4a..fc6c8a70 100644
--- a/include/mysql/plugin_encryption.h.pp
+++ b/include/mysql/plugin_encryption.h.pp
@@ -57,10 +57,17 @@ static inline int encryption_crypt(const unsigned char* src, unsigned int slen,
 {
   void *ctx= alloca(encryption_handler.encryption_ctx_size_func((key_id),(key_version)));
   int res1, res2;
-  unsigned int d1, d2;
+  unsigned int d1, d2= *dlen;
+  assert(*dlen >= slen);
+  assert((dst[*dlen - 1]= 1));
+  if (src < dst)
+    assert(src + slen <= dst);
+  else
+    assert(dst + *dlen <= src);
   if ((res1= encryption_handler.encryption_ctx_init_func((ctx),(key),(klen),(iv),(ivlen),(flags),(key_id),(key_version))))
     return res1;
   res1= encryption_handler.encryption_ctx_update_func((ctx),(src),(slen),(dst),(&d1));
+  d2-= d1;
   res2= encryption_handler.encryption_ctx_finish_func((ctx),(dst + d1),(&d2));
   *dlen= d1 + d2;
   return res1 ? res1 : res2;
@@ -294,35 +301,39 @@ void my_sha512_input(void *context, const unsigned char *buf, size_t len);
 void my_sha512_result(void *context, unsigned char *digest);
 }
 extern "C" {
-struct st_mysql_lex_string
-{
-  char *str;
-  size_t length;
-};
-typedef struct st_mysql_lex_string MYSQL_LEX_STRING;
 struct st_mysql_const_lex_string
 {
   const char *str;
   size_t length;
 };
 typedef struct st_mysql_const_lex_string MYSQL_CONST_LEX_STRING;
+struct st_mysql_lex_string
+{
+  char *str;
+  size_t length;
+  operator struct st_mysql_const_lex_string() const
+  {
+    return {str, length};
+  }
+};
+typedef struct st_mysql_lex_string MYSQL_LEX_STRING;
 extern struct thd_alloc_service_st {
-  void *(*thd_alloc_func)(THD*, size_t);
-  void *(*thd_calloc_func)(THD*, size_t);
-  char *(*thd_strdup_func)(THD*, const char *);
-  char *(*thd_strmake_func)(THD*, const char *, size_t);
-  void *(*thd_memdup_func)(THD*, const void*, size_t);
-  MYSQL_CONST_LEX_STRING *(*thd_make_lex_string_func)(THD*,
+  void *(*thd_alloc_func)(const THD*, size_t);
+  void *(*thd_calloc_func)(const THD*, size_t);
+  char *(*thd_strdup_func)(const THD*, const char *);
+  char *(*thd_strmake_func)(const THD*, const char *, size_t);
+  void *(*thd_memdup_func)(const THD*, const void*, size_t);
+  MYSQL_CONST_LEX_STRING *(*thd_make_lex_string_func)(const THD*,
                                         MYSQL_CONST_LEX_STRING *,
                                         const char *, size_t, int);
 } *thd_alloc_service;
-void *thd_alloc(THD* thd, size_t size);
-void *thd_calloc(THD* thd, size_t size);
-char *thd_strdup(THD* thd, const char *str);
-char *thd_strmake(THD* thd, const char *str, size_t size);
-void *thd_memdup(THD* thd, const void* str, size_t size);
+void *thd_alloc(const THD* thd, size_t size);
+void *thd_calloc(const THD* thd, size_t size);
+char *thd_strdup(const THD* thd, const char *str);
+char *thd_strmake(const THD* thd, const char *str, size_t size);
+void *thd_memdup(const THD* thd, const void* str, size_t size);
 MYSQL_CONST_LEX_STRING
-*thd_make_lex_string(THD* thd, MYSQL_CONST_LEX_STRING *lex_str,
+*thd_make_lex_string(const THD* thd, MYSQL_CONST_LEX_STRING *lex_str,
                      const char *str, size_t size,
                      int allocate_lex_string);
 }
@@ -487,9 +498,12 @@ extern struct sql_service_st {
   int (STDCALL *mysql_set_character_set_func)(MYSQL *mysql, const char *cs_name);
   unsigned int (STDCALL *mysql_num_fields_func)(MYSQL_RES *res);
   int (STDCALL *mysql_select_db_func)(MYSQL *mysql, const char *db);
+  MYSQL_RES *(STDCALL *mysql_use_result_func)(MYSQL *mysql);
+  MYSQL_FIELD *(STDCALL *mysql_fetch_fields_func)(MYSQL_RES *res);
+  unsigned long (STDCALL *mysql_real_escape_string_func)(MYSQL *mysql, char *to,
+                                        const char *from, unsigned long length);
   my_bool (STDCALL *mysql_ssl_set_func)(MYSQL *mysql, const char *key,
-                                        const char *cert, const char *ca,
-                                        const char *capath, const char *cipher);
+      const char *cert, const char *ca, const char *capath, const char *cipher);
 } *sql_service;
 MYSQL *mysql_real_connect_local(MYSQL *mysql);
 }
diff --git a/include/mysql/plugin_ftparser.h.pp b/include/mysql/plugin_ftparser.h.pp
index cc2c276c..85c73919 100644
--- a/include/mysql/plugin_ftparser.h.pp
+++ b/include/mysql/plugin_ftparser.h.pp
@@ -57,10 +57,17 @@ static inline int encryption_crypt(const unsigned char* src, unsigned int slen,
 {
   void *ctx= alloca(encryption_handler.encryption_ctx_size_func((key_id),(key_version)));
   int res1, res2;
-  unsigned int d1, d2;
+  unsigned int d1, d2= *dlen;
+  assert(*dlen >= slen);
+  assert((dst[*dlen - 1]= 1));
+  if (src < dst)
+    assert(src + slen <= dst);
+  else
+    assert(dst + *dlen <= src);
   if ((res1= encryption_handler.encryption_ctx_init_func((ctx),(key),(klen),(iv),(ivlen),(flags),(key_id),(key_version))))
     return res1;
   res1= encryption_handler.encryption_ctx_update_func((ctx),(src),(slen),(dst),(&d1));
+  d2-= d1;
   res2= encryption_handler.encryption_ctx_finish_func((ctx),(dst + d1),(&d2));
   *dlen= d1 + d2;
   return res1 ? res1 : res2;
@@ -294,35 +301,39 @@ void my_sha512_input(void *context, const unsigned char *buf, size_t len);
 void my_sha512_result(void *context, unsigned char *digest);
 }
 extern "C" {
-struct st_mysql_lex_string
-{
-  char *str;
-  size_t length;
-};
-typedef struct st_mysql_lex_string MYSQL_LEX_STRING;
 struct st_mysql_const_lex_string
 {
   const char *str;
   size_t length;
 };
 typedef struct st_mysql_const_lex_string MYSQL_CONST_LEX_STRING;
+struct st_mysql_lex_string
+{
+  char *str;
+  size_t length;
+  operator struct st_mysql_const_lex_string() const
+  {
+    return {str, length};
+  }
+};
+typedef struct st_mysql_lex_string MYSQL_LEX_STRING;
 extern struct thd_alloc_service_st {
-  void *(*thd_alloc_func)(THD*, size_t);
-  void *(*thd_calloc_func)(THD*, size_t);
-  char *(*thd_strdup_func)(THD*, const char *);
-  char *(*thd_strmake_func)(THD*, const char *, size_t);
-  void *(*thd_memdup_func)(THD*, const void*, size_t);
-  MYSQL_CONST_LEX_STRING *(*thd_make_lex_string_func)(THD*,
+  void *(*thd_alloc_func)(const THD*, size_t);
+  void *(*thd_calloc_func)(const THD*, size_t);
+  char *(*thd_strdup_func)(const THD*, const char *);
+  char *(*thd_strmake_func)(const THD*, const char *, size_t);
+  void *(*thd_memdup_func)(const THD*, const void*, size_t);
+  MYSQL_CONST_LEX_STRING *(*thd_make_lex_string_func)(const THD*,
                                         MYSQL_CONST_LEX_STRING *,
                                         const char *, size_t, int);
 } *thd_alloc_service;
-void *thd_alloc(THD* thd, size_t size);
-void *thd_calloc(THD* thd, size_t size);
-char *thd_strdup(THD* thd, const char *str);
-char *thd_strmake(THD* thd, const char *str, size_t size);
-void *thd_memdup(THD* thd, const void* str, size_t size);
+void *thd_alloc(const THD* thd, size_t size);
+void *thd_calloc(const THD* thd, size_t size);
+char *thd_strdup(const THD* thd, const char *str);
+char *thd_strmake(const THD* thd, const char *str, size_t size);
+void *thd_memdup(const THD* thd, const void* str, size_t size);
 MYSQL_CONST_LEX_STRING
-*thd_make_lex_string(THD* thd, MYSQL_CONST_LEX_STRING *lex_str,
+*thd_make_lex_string(const THD* thd, MYSQL_CONST_LEX_STRING *lex_str,
                      const char *str, size_t size,
                      int allocate_lex_string);
 }
@@ -487,9 +498,12 @@ extern struct sql_service_st {
   int (STDCALL *mysql_set_character_set_func)(MYSQL *mysql, const char *cs_name);
   unsigned int (STDCALL *mysql_num_fields_func)(MYSQL_RES *res);
   int (STDCALL *mysql_select_db_func)(MYSQL *mysql, const char *db);
+  MYSQL_RES *(STDCALL *mysql_use_result_func)(MYSQL *mysql);
+  MYSQL_FIELD *(STDCALL *mysql_fetch_fields_func)(MYSQL_RES *res);
+  unsigned long (STDCALL *mysql_real_escape_string_func)(MYSQL *mysql, char *to,
+                                        const char *from, unsigned long length);
   my_bool (STDCALL *mysql_ssl_set_func)(MYSQL *mysql, const char *key,
-                                        const char *cert, const char *ca,
-                                        const char *capath, const char *cipher);
+      const char *cert, const char *ca, const char *capath, const char *cipher);
 } *sql_service;
 MYSQL *mysql_real_connect_local(MYSQL *mysql);
 }
diff --git a/include/mysql/plugin_function.h.pp b/include/mysql/plugin_function.h.pp
index afdcb534..1abb2f47 100644
--- a/include/mysql/plugin_function.h.pp
+++ b/include/mysql/plugin_function.h.pp
@@ -57,10 +57,17 @@ static inline int encryption_crypt(const unsigned char* src, unsigned int slen,
 {
   void *ctx= alloca(encryption_handler.encryption_ctx_size_func((key_id),(key_version)));
   int res1, res2;
-  unsigned int d1, d2;
+  unsigned int d1, d2= *dlen;
+  assert(*dlen >= slen);
+  assert((dst[*dlen - 1]= 1));
+  if (src < dst)
+    assert(src + slen <= dst);
+  else
+    assert(dst + *dlen <= src);
   if ((res1= encryption_handler.encryption_ctx_init_func((ctx),(key),(klen),(iv),(ivlen),(flags),(key_id),(key_version))))
     return res1;
   res1= encryption_handler.encryption_ctx_update_func((ctx),(src),(slen),(dst),(&d1));
+  d2-= d1;
   res2= encryption_handler.encryption_ctx_finish_func((ctx),(dst + d1),(&d2));
   *dlen= d1 + d2;
   return res1 ? res1 : res2;
@@ -294,35 +301,39 @@ void my_sha512_input(void *context, const unsigned char *buf, size_t len);
 void my_sha512_result(void *context, unsigned char *digest);
 }
 extern "C" {
-struct st_mysql_lex_string
-{
-  char *str;
-  size_t length;
-};
-typedef struct st_mysql_lex_string MYSQL_LEX_STRING;
 struct st_mysql_const_lex_string
 {
   const char *str;
   size_t length;
 };
 typedef struct st_mysql_const_lex_string MYSQL_CONST_LEX_STRING;
+struct st_mysql_lex_string
+{
+  char *str;
+  size_t length;
+  operator struct st_mysql_const_lex_string() const
+  {
+    return {str, length};
+  }
+};
+typedef struct st_mysql_lex_string MYSQL_LEX_STRING;
 extern struct thd_alloc_service_st {
-  void *(*thd_alloc_func)(THD*, size_t);
-  void *(*thd_calloc_func)(THD*, size_t);
-  char *(*thd_strdup_func)(THD*, const char *);
-  char *(*thd_strmake_func)(THD*, const char *, size_t);
-  void *(*thd_memdup_func)(THD*, const void*, size_t);
-  MYSQL_CONST_LEX_STRING *(*thd_make_lex_string_func)(THD*,
+  void *(*thd_alloc_func)(const THD*, size_t);
+  void *(*thd_calloc_func)(const THD*, size_t);
+  char *(*thd_strdup_func)(const THD*, const char *);
+  char *(*thd_strmake_func)(const THD*, const char *, size_t);
+  void *(*thd_memdup_func)(const THD*, const void*, size_t);
+  MYSQL_CONST_LEX_STRING *(*thd_make_lex_string_func)(const THD*,
                                         MYSQL_CONST_LEX_STRING *,
                                         const char *, size_t, int);
 } *thd_alloc_service;
-void *thd_alloc(THD* thd, size_t size);
-void *thd_calloc(THD* thd, size_t size);
-char *thd_strdup(THD* thd, const char *str);
-char *thd_strmake(THD* thd, const char *str, size_t size);
-void *thd_memdup(THD* thd, const void* str, size_t size);
+void *thd_alloc(const THD* thd, size_t size);
+void *thd_calloc(const THD* thd, size_t size);
+char *thd_strdup(const THD* thd, const char *str);
+char *thd_strmake(const THD* thd, const char *str, size_t size);
+void *thd_memdup(const THD* thd, const void* str, size_t size);
 MYSQL_CONST_LEX_STRING
-*thd_make_lex_string(THD* thd, MYSQL_CONST_LEX_STRING *lex_str,
+*thd_make_lex_string(const THD* thd, MYSQL_CONST_LEX_STRING *lex_str,
                      const char *str, size_t size,
                      int allocate_lex_string);
 }
@@ -487,9 +498,12 @@ extern struct sql_service_st {
   int (STDCALL *mysql_set_character_set_func)(MYSQL *mysql, const char *cs_name);
   unsigned int (STDCALL *mysql_num_fields_func)(MYSQL_RES *res);
   int (STDCALL *mysql_select_db_func)(MYSQL *mysql, const char *db);
+  MYSQL_RES *(STDCALL *mysql_use_result_func)(MYSQL *mysql);
+  MYSQL_FIELD *(STDCALL *mysql_fetch_fields_func)(MYSQL_RES *res);
+  unsigned long (STDCALL *mysql_real_escape_string_func)(MYSQL *mysql, char *to,
+                                        const char *from, unsigned long length);
   my_bool (STDCALL *mysql_ssl_set_func)(MYSQL *mysql, const char *key,
-                                        const char *cert, const char *ca,
-                                        const char *capath, const char *cipher);
+      const char *cert, const char *ca, const char *capath, const char *cipher);
 } *sql_service;
 MYSQL *mysql_real_connect_local(MYSQL *mysql);
 }
diff --git a/include/mysql/plugin_password_validation.h.pp b/include/mysql/plugin_password_validation.h.pp
index 3f238088..1284a3b0 100644
--- a/include/mysql/plugin_password_validation.h.pp
+++ b/include/mysql/plugin_password_validation.h.pp
@@ -57,10 +57,17 @@ static inline int encryption_crypt(const unsigned char* src, unsigned int slen,
 {
   void *ctx= alloca(encryption_handler.encryption_ctx_size_func((key_id),(key_version)));
   int res1, res2;
-  unsigned int d1, d2;
+  unsigned int d1, d2= *dlen;
+  assert(*dlen >= slen);
+  assert((dst[*dlen - 1]= 1));
+  if (src < dst)
+    assert(src + slen <= dst);
+  else
+    assert(dst + *dlen <= src);
   if ((res1= encryption_handler.encryption_ctx_init_func((ctx),(key),(klen),(iv),(ivlen),(flags),(key_id),(key_version))))
     return res1;
   res1= encryption_handler.encryption_ctx_update_func((ctx),(src),(slen),(dst),(&d1));
+  d2-= d1;
   res2= encryption_handler.encryption_ctx_finish_func((ctx),(dst + d1),(&d2));
   *dlen= d1 + d2;
   return res1 ? res1 : res2;
@@ -294,35 +301,39 @@ void my_sha512_input(void *context, const unsigned char *buf, size_t len);
 void my_sha512_result(void *context, unsigned char *digest);
 }
 extern "C" {
-struct st_mysql_lex_string
-{
-  char *str;
-  size_t length;
-};
-typedef struct st_mysql_lex_string MYSQL_LEX_STRING;
 struct st_mysql_const_lex_string
 {
   const char *str;
   size_t length;
 };
 typedef struct st_mysql_const_lex_string MYSQL_CONST_LEX_STRING;
+struct st_mysql_lex_string
+{
+  char *str;
+  size_t length;
+  operator struct st_mysql_const_lex_string() const
+  {
+    return {str, length};
+  }
+};
+typedef struct st_mysql_lex_string MYSQL_LEX_STRING;
 extern struct thd_alloc_service_st {
-  void *(*thd_alloc_func)(THD*, size_t);
-  void *(*thd_calloc_func)(THD*, size_t);
-  char *(*thd_strdup_func)(THD*, const char *);
-  char *(*thd_strmake_func)(THD*, const char *, size_t);
-  void *(*thd_memdup_func)(THD*, const void*, size_t);
-  MYSQL_CONST_LEX_STRING *(*thd_make_lex_string_func)(THD*,
+  void *(*thd_alloc_func)(const THD*, size_t);
+  void *(*thd_calloc_func)(const THD*, size_t);
+  char *(*thd_strdup_func)(const THD*, const char *);
+  char *(*thd_strmake_func)(const THD*, const char *, size_t);
+  void *(*thd_memdup_func)(const THD*, const void*, size_t);
+  MYSQL_CONST_LEX_STRING *(*thd_make_lex_string_func)(const THD*,
                                         MYSQL_CONST_LEX_STRING *,
                                         const char *, size_t, int);
 } *thd_alloc_service;
-void *thd_alloc(THD* thd, size_t size);
-void *thd_calloc(THD* thd, size_t size);
-char *thd_strdup(THD* thd, const char *str);
-char *thd_strmake(THD* thd, const char *str, size_t size);
-void *thd_memdup(THD* thd, const void* str, size_t size);
+void *thd_alloc(const THD* thd, size_t size);
+void *thd_calloc(const THD* thd, size_t size);
+char *thd_strdup(const THD* thd, const char *str);
+char *thd_strmake(const THD* thd, const char *str, size_t size);
+void *thd_memdup(const THD* thd, const void* str, size_t size);
 MYSQL_CONST_LEX_STRING
-*thd_make_lex_string(THD* thd, MYSQL_CONST_LEX_STRING *lex_str,
+*thd_make_lex_string(const THD* thd, MYSQL_CONST_LEX_STRING *lex_str,
                      const char *str, size_t size,
                      int allocate_lex_string);
 }
@@ -487,9 +498,12 @@ extern struct sql_service_st {
   int (STDCALL *mysql_set_character_set_func)(MYSQL *mysql, const char *cs_name);
   unsigned int (STDCALL *mysql_num_fields_func)(MYSQL_RES *res);
   int (STDCALL *mysql_select_db_func)(MYSQL *mysql, const char *db);
+  MYSQL_RES *(STDCALL *mysql_use_result_func)(MYSQL *mysql);
+  MYSQL_FIELD *(STDCALL *mysql_fetch_fields_func)(MYSQL_RES *res);
+  unsigned long (STDCALL *mysql_real_escape_string_func)(MYSQL *mysql, char *to,
+                                        const char *from, unsigned long length);
   my_bool (STDCALL *mysql_ssl_set_func)(MYSQL *mysql, const char *key,
-                                        const char *cert, const char *ca,
-                                        const char *capath, const char *cipher);
+      const char *cert, const char *ca, const char *capath, const char *cipher);
 } *sql_service;
 MYSQL *mysql_real_connect_local(MYSQL *mysql);
 }
diff --git a/include/mysql/service_encryption.h b/include/mysql/service_encryption.h
index 49639407..812b2861 100644
--- a/include/mysql/service_encryption.h
+++ b/include/mysql/service_encryption.h
@@ -36,6 +36,9 @@
 #ifdef __cplusplus
 extern "C" {
 #endif
+#ifndef MYSQL_ABI_CHECK
+#include <assert.h>
+#endif
 
 /* returned from encryption_key_get_latest_version() */
 #define ENCRYPTION_KEY_VERSION_INVALID        (~(unsigned int)0)
@@ -101,6 +104,11 @@ static inline unsigned int encryption_key_version_exists(unsigned int id, unsign
   return encryption_key_get(id, version, NULL, &unused) != ENCRYPTION_KEY_VERSION_INVALID;
 }
 
+/** main entrypoint to perform encryption or decryption
+ * @invariant `src` is valid for `slen`
+ * @invariant `dst` is valid for `*dlen`, `*dlen` is initialized
+ * @invariant `src` and `dst` do not overlap
+ */
 static inline int encryption_crypt(const unsigned char* src, unsigned int slen,
                                    unsigned char* dst, unsigned int* dlen,
                                    const unsigned char* key, unsigned int klen,
@@ -109,11 +117,23 @@ static inline int encryption_crypt(const unsigned char* src, unsigned int slen,
 {
   void *ctx= alloca(encryption_ctx_size(key_id, key_version));
   int res1, res2;
-  unsigned int d1, d2;
+  unsigned int d1, d2= *dlen;
+
+  // Verify dlen is initialized properly. See MDEV-30389
+  assert(*dlen >= slen);
+  assert((dst[*dlen - 1]= 1));
+  // Verify buffers do not overlap
+  if (src < dst)
+    assert(src + slen <= dst);
+  else
+    assert(dst + *dlen <= src);
+
   if ((res1= encryption_ctx_init(ctx, key, klen, iv, ivlen, flags, key_id, key_version)))
     return res1;
   res1= encryption_ctx_update(ctx, src, slen, dst, &d1);
+  d2-= d1;
   res2= encryption_ctx_finish(ctx, dst + d1, &d2);
+
   *dlen= d1 + d2;
   return res1 ? res1 : res2;
 }
@@ -124,4 +144,3 @@ static inline int encryption_crypt(const unsigned char* src, unsigned int slen,
 
 #define MYSQL_SERVICE_ENCRYPTION_INCLUDED
 #endif
-
diff --git a/include/mysql/service_sql.h b/include/mysql/service_sql.h
index e9d1491d..a4a61cc0 100644
--- a/include/mysql/service_sql.h
+++ b/include/mysql/service_sql.h
@@ -68,9 +68,12 @@ extern struct sql_service_st {
   int (STDCALL *mysql_set_character_set_func)(MYSQL *mysql, const char *cs_name);
   unsigned int (STDCALL *mysql_num_fields_func)(MYSQL_RES *res);
   int (STDCALL *mysql_select_db_func)(MYSQL *mysql, const char *db);
+  MYSQL_RES *(STDCALL *mysql_use_result_func)(MYSQL *mysql);
+  MYSQL_FIELD *(STDCALL *mysql_fetch_fields_func)(MYSQL_RES *res);
+  unsigned long (STDCALL *mysql_real_escape_string_func)(MYSQL *mysql, char *to,
+                                        const char *from, unsigned long length);
   my_bool (STDCALL *mysql_ssl_set_func)(MYSQL *mysql, const char *key,
-                                        const char *cert, const char *ca,
-                                        const char *capath, const char *cipher);
+      const char *cert, const char *ca, const char *capath, const char *cipher);
 } *sql_service;
 
 #ifdef MYSQL_DYNAMIC_PLUGIN
@@ -92,7 +95,10 @@ extern struct sql_service_st {
 #define mysql_set_character_set(M,C) sql_service->mysql_set_character_set_func(M,C)
 #define mysql_num_fields(R) sql_service->mysql_num_fields_func(R)
 #define mysql_select_db(M,D) sql_service->mysql_select_db_func(M,D)
-#define mysql_ssl_set(M,K,C,A,P,H) sql_service->mysql_ssl_set_func(M,K,C,A,P,H)
+#define mysql_use_result(M) sql_service->mysql_use_result_func(M)
+#define mysql_fetch_fields(R) sql_service->mysql_fetch_fields_func(R)
+#define mysql_real_escape_string(M,T,F,L) sql_service->mysql_real_escape_string_func(M,T,F,L)
+#define mysql_ssl_set(M,K,C1,C2,C3,C4) sql_service->mysql_ssl_set_func(M,K,C1,C2,C3,C4)
 
 #else
 
diff --git a/include/mysql/service_thd_alloc.h b/include/mysql/service_thd_alloc.h
index 0be4687b..014277b5 100644
--- a/include/mysql/service_thd_alloc.h
+++ b/include/mysql/service_thd_alloc.h
@@ -35,27 +35,34 @@
 extern "C" {
 #endif
 
-struct st_mysql_lex_string
+struct st_mysql_const_lex_string
 {
-  char *str;
+  const char *str;
   size_t length;
 };
-typedef struct st_mysql_lex_string MYSQL_LEX_STRING;
+typedef struct st_mysql_const_lex_string MYSQL_CONST_LEX_STRING;
 
-struct st_mysql_const_lex_string
+struct st_mysql_lex_string
 {
-  const char *str;
+  char *str;
   size_t length;
+#ifdef __cplusplus
+  // Allow automatic cast from LEX_STRING to LEX_CSTRING in c++.
+  operator struct st_mysql_const_lex_string() const
+  {
+    return {str, length};
+  }
+#endif
 };
-typedef struct st_mysql_const_lex_string MYSQL_CONST_LEX_STRING;
+typedef struct st_mysql_lex_string MYSQL_LEX_STRING;
 
 extern struct thd_alloc_service_st {
-  void *(*thd_alloc_func)(MYSQL_THD, size_t);
-  void *(*thd_calloc_func)(MYSQL_THD, size_t);
-  char *(*thd_strdup_func)(MYSQL_THD, const char *);
-  char *(*thd_strmake_func)(MYSQL_THD, const char *, size_t);
-  void *(*thd_memdup_func)(MYSQL_THD, const void*, size_t);
-  MYSQL_CONST_LEX_STRING *(*thd_make_lex_string_func)(MYSQL_THD,
+  void *(*thd_alloc_func)(const MYSQL_THD, size_t);
+  void *(*thd_calloc_func)(const MYSQL_THD, size_t);
+  char *(*thd_strdup_func)(const MYSQL_THD, const char *);
+  char *(*thd_strmake_func)(const MYSQL_THD, const char *, size_t);
+  void *(*thd_memdup_func)(const MYSQL_THD, const void*, size_t);
+  MYSQL_CONST_LEX_STRING *(*thd_make_lex_string_func)(const MYSQL_THD,
                                         MYSQL_CONST_LEX_STRING *,
                                         const char *, size_t, int);
 } *thd_alloc_service;
@@ -92,23 +99,23 @@ extern struct thd_alloc_service_st {
 
   @see alloc_root()
 */
-void *thd_alloc(MYSQL_THD thd, size_t size);
+void *thd_alloc(const MYSQL_THD thd, size_t size);
 /**
   @see thd_alloc()
 */
-void *thd_calloc(MYSQL_THD thd, size_t size);
+void *thd_calloc(const MYSQL_THD thd, size_t size);
 /**
   @see thd_alloc()
 */
-char *thd_strdup(MYSQL_THD thd, const char *str);
+char *thd_strdup(const MYSQL_THD thd, const char *str);
 /**
   @see thd_alloc()
 */
-char *thd_strmake(MYSQL_THD thd, const char *str, size_t size);
+char *thd_strmake(const MYSQL_THD thd, const char *str, size_t size);
 /**
   @see thd_alloc()
 */
-void *thd_memdup(MYSQL_THD thd, const void* str, size_t size);
+void *thd_memdup(const MYSQL_THD thd, const void* str, size_t size);
 
 /**
   Create a LEX_STRING in this connection's local memory pool
@@ -124,7 +131,7 @@ void *thd_memdup(MYSQL_THD thd, const void* str, size_t size);
   @see thd_alloc()
 */
 MYSQL_CONST_LEX_STRING
-*thd_make_lex_string(MYSQL_THD thd, MYSQL_CONST_LEX_STRING *lex_str,
+*thd_make_lex_string(const MYSQL_THD thd, MYSQL_CONST_LEX_STRING *lex_str,
                      const char *str, size_t size,
                      int allocate_lex_string);