Merging upstream version 1:11.4.2.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

42 files changed, 500 insertions, 401 deletions

diff --git a/include/atomic/generic-msvc.h b/include/atomic/generic-msvc.h
index ff2a5434..8a29f560 100644
--- a/include/atomic/generic-msvc.h
+++ b/include/atomic/generic-msvc.h
@@ -72,7 +72,7 @@ static inline int64 my_atomic_add64(int64 volatile *a, int64 v)
   64-bit Windows. Reads and writes to 64-bit values are not guaranteed to be
   atomic on 32-bit Windows.
 
-  https://msdn.microsoft.com/en-us/library/windows/desktop/ms684122(v=vs.85).aspx
+  https://learn.microsoft.com/en-us/windows/win32/sync/interlocked-variable-access
 */
 
 static inline int32 my_atomic_load32(int32 volatile *a)
@@ -84,7 +84,7 @@ static inline int32 my_atomic_load32(int32 volatile *a)
 
 static inline int64 my_atomic_load64(int64 volatile *a)
 {
-#ifdef _M_X64
+#if defined(_M_X64) || defined(_M_ARM64)
   int64 value= *a;
   MemoryBarrier();
   return value;
@@ -123,7 +123,7 @@ static inline void my_atomic_store32(int32 volatile *a, int32 v)
 
 static inline void my_atomic_store64(int64 volatile *a, int64 v)
 {
-#ifdef _M_X64
+#if defined(_M_X64) || defined(_M_ARM64)
   MemoryBarrier();
   *a= v;
 #else
diff --git a/include/json_lib.h b/include/json_lib.h
index 6342e36a..d4632788 100644
--- a/include/json_lib.h
+++ b/include/json_lib.h
@@ -444,6 +444,11 @@ int json_normalize(DYNAMIC_STRING *result,
 
 int json_skip_array_and_count(json_engine_t *j, int* n_item);
 
+inline static int json_scan_ended(json_engine_t *j)
+{
+  return (j->state == JST_ARRAY_END && j->stack_p == 0);
+}
+
 #ifdef  __cplusplus
 }
 #endif
diff --git a/include/m_ctype.h b/include/m_ctype.h
index 5c68224f..55d3cc0a 100644
--- a/include/m_ctype.h
+++ b/include/m_ctype.h
@@ -287,6 +287,7 @@ extern MY_UNI_CTYPE my_uni_ctype[256];
 #define MY_CS_NON1TO1 0x40000  /* Has a complex mapping from characters
                                   to weights, e.g. contractions, expansions,
                                   ignorable characters */
+#define MY_CS_UPPER_EQUAL_AS_EQUAL 0x80000 /* (UPPER(x)=UPPER(y)) <=> (x=y)*/
 #define MY_CHARSET_UNDEFINED 0
 
 /* Character repertoire flags */
diff --git a/include/m_string.h b/include/m_string.h
index 0360cd38..fcbb3769 100644
--- a/include/m_string.h
+++ b/include/m_string.h
@@ -74,6 +74,7 @@ extern "C" {
 #endif
 
 /* Declared in int2str() */
+extern const char _dig_vec_base62[];
 extern const char _dig_vec_upper[];
 extern const char _dig_vec_lower[];
 
diff --git a/include/mariadb_capi_rename.h b/include/mariadb_capi_rename.h
index 58e16fdc..4f6750d4 100644
--- a/include/mariadb_capi_rename.h
+++ b/include/mariadb_capi_rename.h
@@ -37,16 +37,19 @@
 #define mysql_free_result       MARIADB_ADD_PREFIX(mysql_free_result)
 #define mysql_get_socket        MARIADB_ADD_PREFIX(mysql_get_socket)
 #define mysql_set_character_set MARIADB_ADD_PREFIX(mysql_set_character_set)
+#define mysql_real_escape_string MARIADB_ADD_PREFIX(mysql_real_escape_string)
 #define mysql_get_server_version MARIADB_ADD_PREFIX(mysql_get_server_version)
 #define mysql_error             MARIADB_ADD_PREFIX(mysql_error)
 #define mysql_errno             MARIADB_ADD_PREFIX(mysql_errno)
 #define mysql_num_fields        MARIADB_ADD_PREFIX(mysql_num_fields)
 #define mysql_num_rows          MARIADB_ADD_PREFIX(mysql_num_rows)
 #define mysql_options4          MARIADB_ADD_PREFIX(mysql_options4)
+#define mysql_fetch_fields      MARIADB_ADD_PREFIX(mysql_fetch_fields)
 #define mysql_fetch_lengths     MARIADB_ADD_PREFIX(mysql_fetch_lengths)
 #define mysql_fetch_row         MARIADB_ADD_PREFIX(mysql_fetch_row)
 #define mysql_affected_rows     MARIADB_ADD_PREFIX(mysql_affected_rows)
 #define mysql_store_result      MARIADB_ADD_PREFIX(mysql_store_result)
+#define mysql_use_result        MARIADB_ADD_PREFIX(mysql_use_result)
 #define mysql_select_db         MARIADB_ADD_PREFIX(mysql_select_db)
 #define mysql_get_ssl_cipher    MARIADB_ADD_PREFIX(mysql_get_ssl_cipher)
 #define mysql_ssl_set           MARIADB_ADD_PREFIX(mysql_ssl_set)
diff --git a/include/my_alarm.h b/include/my_alarm.h
deleted file mode 100644
index 652b460c..00000000
--- a/include/my_alarm.h
+++ /dev/null
@@ -1,69 +0,0 @@
-/*
-   Copyright (c) 2000, 2010, Oracle and/or its affiliates.
-
-   This program is free software; you can redistribute it and/or modify
-   it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; version 2 of the License.
-
-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-   GNU General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1335  USA */
-
-/*
-  File to include when we want to use alarm or a loop_counter to display
-  some information when a program is running
-*/
-#ifndef _my_alarm_h
-#define _my_alarm_h
-#ifdef	__cplusplus
-extern "C" {
-#endif
-
-extern int volatile my_have_got_alarm;
-extern ulong my_time_to_wait_for_lock;
-
-#if defined(HAVE_ALARM) && !defined(NO_ALARM_LOOP)
-#include <signal.h>
-#ifdef HAVE_SIGHANDLER_T
-#define sig_return sighandler_t
-#elif defined(SOLARIS) || defined(__sun) || defined(__APPLE__) || \
-    defined(_AIX) || \
-    defined(__FreeBSD__) || defined(__NetBSD__) || defined(__OpenBSD__) || \
-    defined(__DragonFly__)
-typedef void (*sig_return)(int); /* Returns type from signal */
-#else
-typedef void (*sig_return)(void); /* Returns type from signal */
-#endif
-#define ALARM_VARIABLES uint alarm_old=0; \
-			sig_return alarm_signal=0
-#define ALARM_INIT	my_have_got_alarm=0 ; \
-			alarm_old=(uint) alarm(MY_HOW_OFTEN_TO_ALARM); \
-			alarm_signal=signal(SIGALRM,my_set_alarm_variable);
-#define ALARM_END	(void) signal(SIGALRM,alarm_signal); \
-			(void) alarm(alarm_old);
-#define ALARM_TEST	my_have_got_alarm
-#ifdef SIGNAL_HANDLER_RESET_ON_DELIVERY
-#define ALARM_REINIT	(void) alarm(MY_HOW_OFTEN_TO_ALARM); \
-			(void) signal(SIGALRM,my_set_alarm_variable);\
-			my_have_got_alarm=0;
-#else
-#define ALARM_REINIT	(void) alarm((uint) MY_HOW_OFTEN_TO_ALARM); \
-			my_have_got_alarm=0;
-#endif /* SIGNAL_HANDLER_RESET_ON_DELIVERY */
-#else
-#define ALARM_VARIABLES long alarm_pos=0,alarm_end_pos=MY_HOW_OFTEN_TO_WRITE-1
-#define ALARM_INIT
-#define ALARM_END
-#define ALARM_TEST (alarm_pos++ >= alarm_end_pos)
-#define ALARM_REINIT (alarm_end_pos+=MY_HOW_OFTEN_TO_WRITE)
-#endif /* HAVE_ALARM */
-
-#ifdef	__cplusplus
-}
-#endif
-#endif
diff --git a/include/my_base.h b/include/my_base.h
index 3cbd4f7e..b214ad04 100644
--- a/include/my_base.h
+++ b/include/my_base.h
@@ -106,7 +106,8 @@ enum ha_key_alg {
   HA_KEY_ALG_RTREE=	2,		/* R-tree, for spatial searches */
   HA_KEY_ALG_HASH=	3,		/* HASH keys (HEAP tables) */
   HA_KEY_ALG_FULLTEXT=	4,		/* FULLTEXT (MyISAM tables) */
-  HA_KEY_ALG_LONG_HASH= 5		/* long BLOB keys */
+  HA_KEY_ALG_LONG_HASH= 5,		/* long BLOB keys */
+  HA_KEY_ALG_UNIQUE_HASH= 6		/* Internal UNIQUE hash (Aria) */
 };
 
         /* Storage media types */ 
@@ -275,10 +276,17 @@ enum ha_base_keytype {
 #define HA_SPATIAL		1024U   /* For spatial search */
 #define HA_NULL_ARE_EQUAL	2048U	/* NULL in key are cmp as equal */
 #define HA_GENERATED_KEY	8192U	/* Automatically generated key */
+/* 
+  Part of unique hash key. Used only for temporary (work) tables so is not
+  written to .frm files.
+*/
+#define HA_UNIQUE_HASH          262144U
 
         /* The combination of the above can be used for key type comparison. */
-#define HA_KEYFLAG_MASK (HA_NOSAME | HA_AUTO_KEY | HA_FULLTEXT | \
-                         HA_SPATIAL | HA_NULL_ARE_EQUAL | HA_GENERATED_KEY)
+#define HA_KEYFLAG_MASK (HA_NOSAME | HA_AUTO_KEY | \
+                         HA_FULLTEXT | \
+                         HA_SPATIAL | HA_NULL_ARE_EQUAL | HA_GENERATED_KEY | \
+                         HA_UNIQUE_HASH)
 
 /*
   Key contains partial segments.
diff --git a/include/my_compare.h b/include/my_compare.h
index 048e679e..1d66e51e 100644
--- a/include/my_compare.h
+++ b/include/my_compare.h
@@ -281,6 +281,5 @@ typedef enum check_result {
 
 typedef check_result_t (*index_cond_func_t)(void *param);
 typedef check_result_t (*rowid_filter_func_t)(void *param);
-typedef int (*rowid_filter_is_active_func_t)(void *param);
 
 #endif /* _my_compare_h */
diff --git a/include/my_compiler.h b/include/my_compiler.h
index b979b5a5..43b0e48f 100644
--- a/include/my_compiler.h
+++ b/include/my_compiler.h
@@ -164,6 +164,7 @@ program.  The paths leading to call of cold functions within code are
 marked as unlikely by the branch prediction mechanism.  optimize a
 rarely invoked function for size instead for speed. */
 # define ATTRIBUTE_COLD __attribute__((cold))
+# define ATTRIBUTE_MALLOC __attribute__((malloc))
 #elif defined _MSC_VER
 # define ATTRIBUTE_NORETURN __declspec(noreturn)
 # define ATTRIBUTE_NOINLINE __declspec(noinline)
@@ -176,6 +177,10 @@ rarely invoked function for size instead for speed. */
 # define ATTRIBUTE_COLD /* empty */
 #endif
 
+#ifndef ATTRIBUTE_MALLOC
+# define ATTRIBUTE_MALLOC
+#endif
+
 #include <my_attribute.h>
 
 #endif /* MY_COMPILER_INCLUDED */
diff --git a/include/my_getopt.h b/include/my_getopt.h
index ffff706e..26f21bd6 100644
--- a/include/my_getopt.h
+++ b/include/my_getopt.h
@@ -100,7 +100,6 @@ typedef my_bool (*my_get_one_option)(const struct my_option *, const char *, con
 typedef void *(*my_getopt_value)(const char *, uint, const struct my_option *,
                                  int *);
 
-
 extern char *disabled_my_option;
 extern char *autoset_my_option;
 extern my_bool my_getopt_print_errors;
diff --git a/include/my_global.h b/include/my_global.h
index 7da8b73c..e6cbb933 100644
--- a/include/my_global.h
+++ b/include/my_global.h
@@ -676,6 +676,7 @@ typedef SOCKET_SIZE_TYPE size_socket;
   Io buffer size; Must be a power of 2 and a multiple of 512. May be
   smaller what the disk page size. This influences the speed of the
   isam btree library. eg to big to slow.
+  4096 is a common block size on SSDs.
 */
 #define IO_SIZE			4096U
 /*
diff --git a/include/my_pthread.h b/include/my_pthread.h
index ca32fecc..8f3b04a2 100644
--- a/include/my_pthread.h
+++ b/include/my_pthread.h
@@ -178,7 +178,6 @@ extern int my_pthread_create_detached;
 #define PTHREAD_CREATE_DETACHED &my_pthread_create_detached
 #define PTHREAD_SCOPE_SYSTEM  PTHREAD_SCOPE_GLOBAL
 #define PTHREAD_SCOPE_PROCESS PTHREAD_SCOPE_LOCAL
-#define USE_ALARM_THREAD
 #endif /* defined(PTHREAD_SCOPE_GLOBAL) && !defined(PTHREAD_SCOPE_SYSTEM) */
 
 #if defined(_BSDI_VERSION) && _BSDI_VERSION < 199910
diff --git a/include/my_service_manager.h b/include/my_service_manager.h
index 498fc762..5b797718 100644
--- a/include/my_service_manager.h
+++ b/include/my_service_manager.h
@@ -37,6 +37,7 @@
 #endif
 
 #else
+#define sd_listen_fds(FD) (0)
 #define sd_listen_fds_with_names(FD, NAMES) (0)
 #define sd_is_socket_unix(FD, TYPE, LISTENING, PATH, SIZE) (0)
 #define sd_is_socket_inet(FD, FAMILY, TYPE, LISTENING, PORT) (0)
diff --git a/include/my_sys.h b/include/my_sys.h
index e4ab497a..f0ed1160 100644
--- a/include/my_sys.h
+++ b/include/my_sys.h
@@ -341,6 +341,14 @@ typedef struct st_dynamic_array
   myf malloc_flags;
 } DYNAMIC_ARRAY;
 
+
+typedef struct st_dynamic_array_append
+{
+  DYNAMIC_ARRAY *array;
+  uchar *pos, *end;
+} DYNAMIC_ARRAY_APPEND;
+
+
 typedef struct st_my_tmpdir
 {
   DYNAMIC_ARRAY full_list;
@@ -600,6 +608,8 @@ static inline size_t my_b_bytes_in_cache(const IO_CACHE *info)
 
 int my_b_copy_to_file    (IO_CACHE *cache, FILE *file, size_t count);
 int my_b_copy_all_to_file(IO_CACHE *cache, FILE *file);
+int my_b_copy_to_cache(IO_CACHE *from_cache, IO_CACHE *to_cache, size_t count);
+int my_b_copy_all_to_cache(IO_CACHE *from_cache, IO_CACHE *to_cache);
 
 my_off_t my_b_append_tell(IO_CACHE* info);
 my_off_t my_b_safe_tell(IO_CACHE* info); /* picks the correct tell() */
@@ -771,7 +781,7 @@ extern int flush_write_cache(RECORD_CACHE *info);
 extern void handle_recived_signals(void);
 
 extern sig_handler my_set_alarm_variable(int signo);
-extern my_bool radixsort_is_appliccable(uint n_items, size_t size_of_element);
+extern my_bool radixsort_is_applicable(uint n_items, size_t size_of_element);
 extern void my_string_ptr_sort(uchar *base,uint items,size_t size);
 extern void radixsort_for_str_ptr(uchar* base[], uint number_of_elements,
 				  size_t size_of_element,uchar *buffer[]);
@@ -845,6 +855,10 @@ extern void freeze_size(DYNAMIC_ARRAY *array);
 #define push_dynamic(A,B) insert_dynamic((A),(B))
 #define reset_dynamic(array) ((array)->elements= 0)
 #define sort_dynamic(A,cmp) my_qsort((A)->buffer, (A)->elements, (A)->size_of_element, (cmp))
+extern void init_append_dynamic(DYNAMIC_ARRAY_APPEND *append,
+                                DYNAMIC_ARRAY *array);
+extern my_bool append_dynamic(DYNAMIC_ARRAY_APPEND *append,
+                              const void * element);
 
 extern my_bool init_dynamic_string(DYNAMIC_STRING *str, const char *init_str,
 				   size_t init_alloc,size_t alloc_increment);
@@ -901,6 +915,20 @@ extern char *strmake_root(MEM_ROOT *root,const char *str,size_t len);
 extern void *memdup_root(MEM_ROOT *root,const void *str, size_t len);
 
 extern LEX_CSTRING safe_lexcstrdup_root(MEM_ROOT *root, const LEX_CSTRING str);
+
+static inline LEX_STRING lex_string_strmake_root(MEM_ROOT *mem_root,
+                                                 const char *str, size_t length)
+{
+  LEX_STRING tmp;
+  tmp.str= strmake_root(mem_root, str, length);
+  tmp.length= tmp.str ? length : 0;
+  return tmp;
+}
+
+extern LEX_STRING lex_string_casedn_root(MEM_ROOT *root,
+                                        CHARSET_INFO *cs,
+                                        const char *str, size_t length);
+
 extern my_bool my_compress(uchar *, size_t *, size_t *);
 extern my_bool my_uncompress(uchar *, size_t , size_t *);
 extern uchar *my_compress_alloc(const uchar *packet, size_t *len,
@@ -1050,6 +1078,18 @@ static inline void my_uuid2str(const uchar *guid, char *s, int with_separators)
 
 const char *my_dlerror(const char *dlpath);
 
+
+/* System timezone handling*/
+void my_tzset();
+void my_tzname(char *sys_timezone, size_t size);
+
+struct my_tz
+{
+  long seconds_offset;
+  char abbreviation[64];
+};
+void my_tzinfo(time_t t, struct my_tz*);
+
 /* character sets */
 extern void my_charset_loader_init_mysys(MY_CHARSET_LOADER *loader);
 extern uint get_charset_number(const char *cs_name, uint cs_flags, myf flags);
diff --git a/include/my_tracker.h b/include/my_tracker.h
new file mode 100644
index 00000000..88cefe5e
--- /dev/null
+++ b/include/my_tracker.h
@@ -0,0 +1,41 @@
+/* Copyright (c) 2022, MariaDB Corporation.
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; version 2 of the License.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1335  USA */
+
+/*
+  Trivial framework to add a tracker to a C function
+*/
+
+#include "my_rdtsc.h"
+
+struct my_time_tracker
+{
+  ulonglong counter;
+  ulonglong cycles;
+};
+
+#ifdef HAVE_TIME_TRACKING
+#define START_TRACKING ulonglong my_start_time= my_timer_cycles()
+#define END_TRACKING(var) \
+  { \
+     ulonglong my_end_time= my_timer_cycles();                     \
+     (var)->counter++;                                             \
+     (var)->cycles+= (unlikely(my_end_time < my_start_time) ?      \
+                     my_end_time - my_start_time + ULONGLONG_MAX : \
+                     my_end_time - my_start_time);                 \
+  }
+#else
+#define START_TRACKING
+#define END_TRACKING(var) do { } while(0)
+#endif
diff --git a/include/myisam.h b/include/myisam.h
index c90026bf..dd4f9084 100644
--- a/include/myisam.h
+++ b/include/myisam.h
@@ -435,6 +435,8 @@ int thr_write_keys(MI_SORT_PARAM *sort_param);
 int sort_write_record(MI_SORT_PARAM *sort_param);
 int _create_index_by_sort(MI_SORT_PARAM *info,my_bool no_messages, ulonglong);
 my_bool mi_too_big_key_for_sort(MI_KEYDEF *key, ha_rows rows);
+struct OPTIMIZER_COSTS;
+void myisam_update_optimizer_costs(struct OPTIMIZER_COSTS *costs);
 
 #ifdef	__cplusplus
 }
diff --git a/include/mysql.h b/include/mysql.h
index 486f57fb..3f59fa3e 100644
--- a/include/mysql.h
+++ b/include/mysql.h
@@ -289,8 +289,9 @@ typedef struct st_mysql
   /* session-wide random string */
   char	        scramble[SCRAMBLE_LENGTH+1];
   my_bool       auto_local_infile;
-  void *unused2, *unused3, *unused4;
+  void          *unused2, *unused3;
   MYSQL_FIELD	*fields;
+  const char    *tls_self_signed_error;
 
   LIST  *stmts;                     /* list of all statements */
   const struct st_mysql_methods *methods;
diff --git a/include/mysql/client_plugin.h b/include/mysql/client_plugin.h
index 990cecc9..404c3f1e 100644
--- a/include/mysql/client_plugin.h
+++ b/include/mysql/client_plugin.h
@@ -56,7 +56,7 @@
 #define MYSQL_CLIENT_reserved2               1
 #define MYSQL_CLIENT_AUTHENTICATION_PLUGIN   2
 
-#define MYSQL_CLIENT_AUTHENTICATION_PLUGIN_INTERFACE_VERSION  0x0100
+#define MYSQL_CLIENT_AUTHENTICATION_PLUGIN_INTERFACE_VERSION  0x0101
 
 #define MYSQL_CLIENT_MAX_PLUGINS             3
 
@@ -96,6 +96,7 @@ struct st_mysql_client_plugin_AUTHENTICATION
 {
   MYSQL_CLIENT_PLUGIN_HEADER
   int (*authenticate_user)(MYSQL_PLUGIN_VIO *vio, struct st_mysql *mysql);
+  int (*hash_password_bin)(struct st_mysql *mysql, unsigned char *hash, size_t *hash_length);
 };
 
 #include <mysql/auth_dialog_client.h>
diff --git a/include/mysql/client_plugin.h.pp b/include/mysql/client_plugin.h.pp
index b6ba9cf0..ff35364b 100644
--- a/include/mysql/client_plugin.h.pp
+++ b/include/mysql/client_plugin.h.pp
@@ -22,6 +22,7 @@ struct st_mysql_client_plugin_AUTHENTICATION
 {
   int type; unsigned int interface_version; const char *name; const char *author; const char *desc; unsigned int version[3]; const char *license; void *mysql_api; int (*init)(char *, size_t, int, va_list); int (*deinit)(); int (*options)(const char *option, const void *);
   int (*authenticate_user)(MYSQL_PLUGIN_VIO *vio, struct st_mysql *mysql);
+  int (*hash_password_bin)(struct st_mysql *mysql, unsigned char *hash, size_t *hash_length);
 };
 struct st_mysql;
 typedef char *(*mysql_authentication_dialog_ask_t)(struct st_mysql *mysql,
diff --git a/include/mysql/plugin_audit.h.pp b/include/mysql/plugin_audit.h.pp
index 57ba61d3..e13acc71 100644
--- a/include/mysql/plugin_audit.h.pp
+++ b/include/mysql/plugin_audit.h.pp
@@ -57,10 +57,17 @@ static inline int encryption_crypt(const unsigned char* src, unsigned int slen,
 {
   void *ctx= alloca(encryption_handler.encryption_ctx_size_func((key_id),(key_version)));
   int res1, res2;
-  unsigned int d1, d2;
+  unsigned int d1, d2= *dlen;
+  assert(*dlen >= slen);
+  assert((dst[*dlen - 1]= 1));
+  if (src < dst)
+    assert(src + slen <= dst);
+  else
+    assert(dst + *dlen <= src);
   if ((res1= encryption_handler.encryption_ctx_init_func((ctx),(key),(klen),(iv),(ivlen),(flags),(key_id),(key_version))))
     return res1;
   res1= encryption_handler.encryption_ctx_update_func((ctx),(src),(slen),(dst),(&d1));
+  d2-= d1;
   res2= encryption_handler.encryption_ctx_finish_func((ctx),(dst + d1),(&d2));
   *dlen= d1 + d2;
   return res1 ? res1 : res2;
@@ -294,35 +301,39 @@ void my_sha512_input(void *context, const unsigned char *buf, size_t len);
 void my_sha512_result(void *context, unsigned char *digest);
 }
 extern "C" {
-struct st_mysql_lex_string
-{
-  char *str;
-  size_t length;
-};
-typedef struct st_mysql_lex_string MYSQL_LEX_STRING;
 struct st_mysql_const_lex_string
 {
   const char *str;
   size_t length;
 };
 typedef struct st_mysql_const_lex_string MYSQL_CONST_LEX_STRING;
+struct st_mysql_lex_string
+{
+  char *str;
+  size_t length;
+  operator struct st_mysql_const_lex_string() const
+  {
+    return {str, length};
+  }
+};
+typedef struct st_mysql_lex_string MYSQL_LEX_STRING;
 extern struct thd_alloc_service_st {
-  void *(*thd_alloc_func)(THD*, size_t);
-  void *(*thd_calloc_func)(THD*, size_t);
-  char *(*thd_strdup_func)(THD*, const char *);
-  char *(*thd_strmake_func)(THD*, const char *, size_t);
-  void *(*thd_memdup_func)(THD*, const void*, size_t);
-  MYSQL_CONST_LEX_STRING *(*thd_make_lex_string_func)(THD*,
+  void *(*thd_alloc_func)(const THD*, size_t);
+  void *(*thd_calloc_func)(const THD*, size_t);
+  char *(*thd_strdup_func)(const THD*, const char *);
+  char *(*thd_strmake_func)(const THD*, const char *, size_t);
+  void *(*thd_memdup_func)(const THD*, const void*, size_t);
+  MYSQL_CONST_LEX_STRING *(*thd_make_lex_string_func)(const THD*,
                                         MYSQL_CONST_LEX_STRING *,
                                         const char *, size_t, int);
 } *thd_alloc_service;
-void *thd_alloc(THD* thd, size_t size);
-void *thd_calloc(THD* thd, size_t size);
-char *thd_strdup(THD* thd, const char *str);
-char *thd_strmake(THD* thd, const char *str, size_t size);
-void *thd_memdup(THD* thd, const void* str, size_t size);
+void *thd_alloc(const THD* thd, size_t size);
+void *thd_calloc(const THD* thd, size_t size);
+char *thd_strdup(const THD* thd, const char *str);
+char *thd_strmake(const THD* thd, const char *str, size_t size);
+void *thd_memdup(const THD* thd, const void* str, size_t size);
 MYSQL_CONST_LEX_STRING
-*thd_make_lex_string(THD* thd, MYSQL_CONST_LEX_STRING *lex_str,
+*thd_make_lex_string(const THD* thd, MYSQL_CONST_LEX_STRING *lex_str,
                      const char *str, size_t size,
                      int allocate_lex_string);
 }
@@ -487,9 +498,12 @@ extern struct sql_service_st {
   int (STDCALL *mysql_set_character_set_func)(MYSQL *mysql, const char *cs_name);
   unsigned int (STDCALL *mysql_num_fields_func)(MYSQL_RES *res);
   int (STDCALL *mysql_select_db_func)(MYSQL *mysql, const char *db);
+  MYSQL_RES *(STDCALL *mysql_use_result_func)(MYSQL *mysql);
+  MYSQL_FIELD *(STDCALL *mysql_fetch_fields_func)(MYSQL_RES *res);
+  unsigned long (STDCALL *mysql_real_escape_string_func)(MYSQL *mysql, char *to,
+                                        const char *from, unsigned long length);
   my_bool (STDCALL *mysql_ssl_set_func)(MYSQL *mysql, const char *key,
-                                        const char *cert, const char *ca,
-                                        const char *capath, const char *cipher);
+      const char *cert, const char *ca, const char *capath, const char *cipher);
 } *sql_service;
 MYSQL *mysql_real_connect_local(MYSQL *mysql);
 }
diff --git a/include/mysql/plugin_auth.h.pp b/include/mysql/plugin_auth.h.pp
index 15e4c0cd..442eeb9c 100644
--- a/include/mysql/plugin_auth.h.pp
+++ b/include/mysql/plugin_auth.h.pp
@@ -57,10 +57,17 @@ static inline int encryption_crypt(const unsigned char* src, unsigned int slen,
 {
   void *ctx= alloca(encryption_handler.encryption_ctx_size_func((key_id),(key_version)));
   int res1, res2;
-  unsigned int d1, d2;
+  unsigned int d1, d2= *dlen;
+  assert(*dlen >= slen);
+  assert((dst[*dlen - 1]= 1));
+  if (src < dst)
+    assert(src + slen <= dst);
+  else
+    assert(dst + *dlen <= src);
   if ((res1= encryption_handler.encryption_ctx_init_func((ctx),(key),(klen),(iv),(ivlen),(flags),(key_id),(key_version))))
     return res1;
   res1= encryption_handler.encryption_ctx_update_func((ctx),(src),(slen),(dst),(&d1));
+  d2-= d1;
   res2= encryption_handler.encryption_ctx_finish_func((ctx),(dst + d1),(&d2));
   *dlen= d1 + d2;
   return res1 ? res1 : res2;
@@ -294,35 +301,39 @@ void my_sha512_input(void *context, const unsigned char *buf, size_t len);
 void my_sha512_result(void *context, unsigned char *digest);
 }
 extern "C" {
-struct st_mysql_lex_string
-{
-  char *str;
-  size_t length;
-};
-typedef struct st_mysql_lex_string MYSQL_LEX_STRING;
 struct st_mysql_const_lex_string
 {
   const char *str;
   size_t length;
 };
 typedef struct st_mysql_const_lex_string MYSQL_CONST_LEX_STRING;
+struct st_mysql_lex_string
+{
+  char *str;
+  size_t length;
+  operator struct st_mysql_const_lex_string() const
+  {
+    return {str, length};
+  }
+};
+typedef struct st_mysql_lex_string MYSQL_LEX_STRING;
 extern struct thd_alloc_service_st {
-  void *(*thd_alloc_func)(THD*, size_t);
-  void *(*thd_calloc_func)(THD*, size_t);
-  char *(*thd_strdup_func)(THD*, const char *);
-  char *(*thd_strmake_func)(THD*, const char *, size_t);
-  void *(*thd_memdup_func)(THD*, const void*, size_t);
-  MYSQL_CONST_LEX_STRING *(*thd_make_lex_string_func)(THD*,
+  void *(*thd_alloc_func)(const THD*, size_t);
+  void *(*thd_calloc_func)(const THD*, size_t);
+  char *(*thd_strdup_func)(const THD*, const char *);
+  char *(*thd_strmake_func)(const THD*, const char *, size_t);
+  void *(*thd_memdup_func)(const THD*, const void*, size_t);
+  MYSQL_CONST_LEX_STRING *(*thd_make_lex_string_func)(const THD*,
                                         MYSQL_CONST_LEX_STRING *,
                                         const char *, size_t, int);
 } *thd_alloc_service;
-void *thd_alloc(THD* thd, size_t size);
-void *thd_calloc(THD* thd, size_t size);
-char *thd_strdup(THD* thd, const char *str);
-char *thd_strmake(THD* thd, const char *str, size_t size);
-void *thd_memdup(THD* thd, const void* str, size_t size);
+void *thd_alloc(const THD* thd, size_t size);
+void *thd_calloc(const THD* thd, size_t size);
+char *thd_strdup(const THD* thd, const char *str);
+char *thd_strmake(const THD* thd, const char *str, size_t size);
+void *thd_memdup(const THD* thd, const void* str, size_t size);
 MYSQL_CONST_LEX_STRING
-*thd_make_lex_string(THD* thd, MYSQL_CONST_LEX_STRING *lex_str,
+*thd_make_lex_string(const THD* thd, MYSQL_CONST_LEX_STRING *lex_str,
                      const char *str, size_t size,
                      int allocate_lex_string);
 }
@@ -487,9 +498,12 @@ extern struct sql_service_st {
   int (STDCALL *mysql_set_character_set_func)(MYSQL *mysql, const char *cs_name);
   unsigned int (STDCALL *mysql_num_fields_func)(MYSQL_RES *res);
   int (STDCALL *mysql_select_db_func)(MYSQL *mysql, const char *db);
+  MYSQL_RES *(STDCALL *mysql_use_result_func)(MYSQL *mysql);
+  MYSQL_FIELD *(STDCALL *mysql_fetch_fields_func)(MYSQL_RES *res);
+  unsigned long (STDCALL *mysql_real_escape_string_func)(MYSQL *mysql, char *to,
+                                        const char *from, unsigned long length);
   my_bool (STDCALL *mysql_ssl_set_func)(MYSQL *mysql, const char *key,
-                                        const char *cert, const char *ca,
-                                        const char *capath, const char *cipher);
+      const char *cert, const char *ca, const char *capath, const char *cipher);
 } *sql_service;
 MYSQL *mysql_real_connect_local(MYSQL *mysql);
 }
diff --git a/include/mysql/plugin_auth_common.h b/include/mysql/plugin_auth_common.h
index 8edd7128..cba0257f 100644
--- a/include/mysql/plugin_auth_common.h
+++ b/include/mysql/plugin_auth_common.h
@@ -85,6 +85,8 @@
   authentication protocol is not known in advance, and the client plugin
   needs to read one packet more to determine if the authentication is finished
   or not.
+
+  Server plugins should not return this value.
 */
 #define CR_OK_HANDSHAKE_COMPLETE -2
 
diff --git a/include/mysql/plugin_data_type.h.pp b/include/mysql/plugin_data_type.h.pp
index 7938bf3c..5d5812e5 100644
--- a/include/mysql/plugin_data_type.h.pp
+++ b/include/mysql/plugin_data_type.h.pp
@@ -57,10 +57,17 @@ static inline int encryption_crypt(const unsigned char* src, unsigned int slen,
 {
   void *ctx= alloca(encryption_handler.encryption_ctx_size_func((key_id),(key_version)));
   int res1, res2;
-  unsigned int d1, d2;
+  unsigned int d1, d2= *dlen;
+  assert(*dlen >= slen);
+  assert((dst[*dlen - 1]= 1));
+  if (src < dst)
+    assert(src + slen <= dst);
+  else
+    assert(dst + *dlen <= src);
   if ((res1= encryption_handler.encryption_ctx_init_func((ctx),(key),(klen),(iv),(ivlen),(flags),(key_id),(key_version))))
     return res1;
   res1= encryption_handler.encryption_ctx_update_func((ctx),(src),(slen),(dst),(&d1));
+  d2-= d1;
   res2= encryption_handler.encryption_ctx_finish_func((ctx),(dst + d1),(&d2));
   *dlen= d1 + d2;
   return res1 ? res1 : res2;
@@ -294,35 +301,39 @@ void my_sha512_input(void *context, const unsigned char *buf, size_t len);
 void my_sha512_result(void *context, unsigned char *digest);
 }
 extern "C" {
-struct st_mysql_lex_string
-{
-  char *str;
-  size_t length;
-};
-typedef struct st_mysql_lex_string MYSQL_LEX_STRING;
 struct st_mysql_const_lex_string
 {
   const char *str;
   size_t length;
 };
 typedef struct st_mysql_const_lex_string MYSQL_CONST_LEX_STRING;
+struct st_mysql_lex_string
+{
+  char *str;
+  size_t length;
+  operator struct st_mysql_const_lex_string() const
+  {
+    return {str, length};
+  }
+};
+typedef struct st_mysql_lex_string MYSQL_LEX_STRING;
 extern struct thd_alloc_service_st {
-  void *(*thd_alloc_func)(THD*, size_t);
-  void *(*thd_calloc_func)(THD*, size_t);
-  char *(*thd_strdup_func)(THD*, const char *);
-  char *(*thd_strmake_func)(THD*, const char *, size_t);
-  void *(*thd_memdup_func)(THD*, const void*, size_t);
-  MYSQL_CONST_LEX_STRING *(*thd_make_lex_string_func)(THD*,
+  void *(*thd_alloc_func)(const THD*, size_t);
+  void *(*thd_calloc_func)(const THD*, size_t);
+  char *(*thd_strdup_func)(const THD*, const char *);
+  char *(*thd_strmake_func)(const THD*, const char *, size_t);
+  void *(*thd_memdup_func)(const THD*, const void*, size_t);
+  MYSQL_CONST_LEX_STRING *(*thd_make_lex_string_func)(const THD*,
                                         MYSQL_CONST_LEX_STRING *,
                                         const char *, size_t, int);
 } *thd_alloc_service;
-void *thd_alloc(THD* thd, size_t size);
-void *thd_calloc(THD* thd, size_t size);
-char *thd_strdup(THD* thd, const char *str);
-char *thd_strmake(THD* thd, const char *str, size_t size);
-void *thd_memdup(THD* thd, const void* str, size_t size);
+void *thd_alloc(const THD* thd, size_t size);
+void *thd_calloc(const THD* thd, size_t size);
+char *thd_strdup(const THD* thd, const char *str);
+char *thd_strmake(const THD* thd, const char *str, size_t size);
+void *thd_memdup(const THD* thd, const void* str, size_t size);
 MYSQL_CONST_LEX_STRING
-*thd_make_lex_string(THD* thd, MYSQL_CONST_LEX_STRING *lex_str,
+*thd_make_lex_string(const THD* thd, MYSQL_CONST_LEX_STRING *lex_str,
                      const char *str, size_t size,
                      int allocate_lex_string);
 }
@@ -487,9 +498,12 @@ extern struct sql_service_st {
   int (STDCALL *mysql_set_character_set_func)(MYSQL *mysql, const char *cs_name);
   unsigned int (STDCALL *mysql_num_fields_func)(MYSQL_RES *res);
   int (STDCALL *mysql_select_db_func)(MYSQL *mysql, const char *db);
+  MYSQL_RES *(STDCALL *mysql_use_result_func)(MYSQL *mysql);
+  MYSQL_FIELD *(STDCALL *mysql_fetch_fields_func)(MYSQL_RES *res);
+  unsigned long (STDCALL *mysql_real_escape_string_func)(MYSQL *mysql, char *to,
+                                        const char *from, unsigned long length);
   my_bool (STDCALL *mysql_ssl_set_func)(MYSQL *mysql, const char *key,
-                                        const char *cert, const char *ca,
-                                        const char *capath, const char *cipher);
+      const char *cert, const char *ca, const char *capath, const char *cipher);
 } *sql_service;
 MYSQL *mysql_real_connect_local(MYSQL *mysql);
 }
diff --git a/include/mysql/plugin_encryption.h b/include/mysql/plugin_encryption.h
index 3c574aa4..a036e221 100644
--- a/include/mysql/plugin_encryption.h
+++ b/include/mysql/plugin_encryption.h
@@ -96,8 +96,11 @@ struct st_mariadb_encryption
   /**
     processes (encrypts or decrypts) a chunk of data
 
-    writes the output to th dst buffer. note that it might write
+    writes the output to the dst buffer. note that it might write
     more bytes that were in the input. or less. or none at all.
+
+    dlen points to the starting lenght of the output buffer. Upon return, it
+    should be set to the number of bytes written.
   */
   int (*crypt_ctx_update)(void *ctx, const unsigned char* src, unsigned int slen,
                           unsigned char* dst, unsigned int* dlen);
@@ -123,4 +126,3 @@ struct st_mariadb_encryption
 }
 #endif
 #endif
-
diff --git a/include/mysql/plugin_encryption.h.pp b/include/mysql/plugin_encryption.h.pp
index 97191c4a..fc6c8a70 100644
--- a/include/mysql/plugin_encryption.h.pp
+++ b/include/mysql/plugin_encryption.h.pp
@@ -57,10 +57,17 @@ static inline int encryption_crypt(const unsigned char* src, unsigned int slen,
 {
   void *ctx= alloca(encryption_handler.encryption_ctx_size_func((key_id),(key_version)));
   int res1, res2;
-  unsigned int d1, d2;
+  unsigned int d1, d2= *dlen;
+  assert(*dlen >= slen);
+  assert((dst[*dlen - 1]= 1));
+  if (src < dst)
+    assert(src + slen <= dst);
+  else
+    assert(dst + *dlen <= src);
   if ((res1= encryption_handler.encryption_ctx_init_func((ctx),(key),(klen),(iv),(ivlen),(flags),(key_id),(key_version))))
     return res1;
   res1= encryption_handler.encryption_ctx_update_func((ctx),(src),(slen),(dst),(&d1));
+  d2-= d1;
   res2= encryption_handler.encryption_ctx_finish_func((ctx),(dst + d1),(&d2));
   *dlen= d1 + d2;
   return res1 ? res1 : res2;
@@ -294,35 +301,39 @@ void my_sha512_input(void *context, const unsigned char *buf, size_t len);
 void my_sha512_result(void *context, unsigned char *digest);
 }
 extern "C" {
-struct st_mysql_lex_string
-{
-  char *str;
-  size_t length;
-};
-typedef struct st_mysql_lex_string MYSQL_LEX_STRING;
 struct st_mysql_const_lex_string
 {
   const char *str;
   size_t length;
 };
 typedef struct st_mysql_const_lex_string MYSQL_CONST_LEX_STRING;
+struct st_mysql_lex_string
+{
+  char *str;
+  size_t length;
+  operator struct st_mysql_const_lex_string() const
+  {
+    return {str, length};
+  }
+};
+typedef struct st_mysql_lex_string MYSQL_LEX_STRING;
 extern struct thd_alloc_service_st {
-  void *(*thd_alloc_func)(THD*, size_t);
-  void *(*thd_calloc_func)(THD*, size_t);
-  char *(*thd_strdup_func)(THD*, const char *);
-  char *(*thd_strmake_func)(THD*, const char *, size_t);
-  void *(*thd_memdup_func)(THD*, const void*, size_t);
-  MYSQL_CONST_LEX_STRING *(*thd_make_lex_string_func)(THD*,
+  void *(*thd_alloc_func)(const THD*, size_t);
+  void *(*thd_calloc_func)(const THD*, size_t);
+  char *(*thd_strdup_func)(const THD*, const char *);
+  char *(*thd_strmake_func)(const THD*, const char *, size_t);
+  void *(*thd_memdup_func)(const THD*, const void*, size_t);
+  MYSQL_CONST_LEX_STRING *(*thd_make_lex_string_func)(const THD*,
                                         MYSQL_CONST_LEX_STRING *,
                                         const char *, size_t, int);
 } *thd_alloc_service;
-void *thd_alloc(THD* thd, size_t size);
-void *thd_calloc(THD* thd, size_t size);
-char *thd_strdup(THD* thd, const char *str);
-char *thd_strmake(THD* thd, const char *str, size_t size);
-void *thd_memdup(THD* thd, const void* str, size_t size);
+void *thd_alloc(const THD* thd, size_t size);
+void *thd_calloc(const THD* thd, size_t size);
+char *thd_strdup(const THD* thd, const char *str);
+char *thd_strmake(const THD* thd, const char *str, size_t size);
+void *thd_memdup(const THD* thd, const void* str, size_t size);
 MYSQL_CONST_LEX_STRING
-*thd_make_lex_string(THD* thd, MYSQL_CONST_LEX_STRING *lex_str,
+*thd_make_lex_string(const THD* thd, MYSQL_CONST_LEX_STRING *lex_str,
                      const char *str, size_t size,
                      int allocate_lex_string);
 }
@@ -487,9 +498,12 @@ extern struct sql_service_st {
   int (STDCALL *mysql_set_character_set_func)(MYSQL *mysql, const char *cs_name);
   unsigned int (STDCALL *mysql_num_fields_func)(MYSQL_RES *res);
   int (STDCALL *mysql_select_db_func)(MYSQL *mysql, const char *db);
+  MYSQL_RES *(STDCALL *mysql_use_result_func)(MYSQL *mysql);
+  MYSQL_FIELD *(STDCALL *mysql_fetch_fields_func)(MYSQL_RES *res);
+  unsigned long (STDCALL *mysql_real_escape_string_func)(MYSQL *mysql, char *to,
+                                        const char *from, unsigned long length);
   my_bool (STDCALL *mysql_ssl_set_func)(MYSQL *mysql, const char *key,
-                                        const char *cert, const char *ca,
-                                        const char *capath, const char *cipher);
+      const char *cert, const char *ca, const char *capath, const char *cipher);
 } *sql_service;
 MYSQL *mysql_real_connect_local(MYSQL *mysql);
 }
diff --git a/include/mysql/plugin_ftparser.h.pp b/include/mysql/plugin_ftparser.h.pp
index cc2c276c..85c73919 100644
--- a/include/mysql/plugin_ftparser.h.pp
+++ b/include/mysql/plugin_ftparser.h.pp
@@ -57,10 +57,17 @@ static inline int encryption_crypt(const unsigned char* src, unsigned int slen,
 {
   void *ctx= alloca(encryption_handler.encryption_ctx_size_func((key_id),(key_version)));
   int res1, res2;
-  unsigned int d1, d2;
+  unsigned int d1, d2= *dlen;
+  assert(*dlen >= slen);
+  assert((dst[*dlen - 1]= 1));
+  if (src < dst)
+    assert(src + slen <= dst);
+  else
+    assert(dst + *dlen <= src);
   if ((res1= encryption_handler.encryption_ctx_init_func((ctx),(key),(klen),(iv),(ivlen),(flags),(key_id),(key_version))))
     return res1;
   res1= encryption_handler.encryption_ctx_update_func((ctx),(src),(slen),(dst),(&d1));
+  d2-= d1;
   res2= encryption_handler.encryption_ctx_finish_func((ctx),(dst + d1),(&d2));
   *dlen= d1 + d2;
   return res1 ? res1 : res2;
@@ -294,35 +301,39 @@ void my_sha512_input(void *context, const unsigned char *buf, size_t len);
 void my_sha512_result(void *context, unsigned char *digest);
 }
 extern "C" {
-struct st_mysql_lex_string
-{
-  char *str;
-  size_t length;
-};
-typedef struct st_mysql_lex_string MYSQL_LEX_STRING;
 struct st_mysql_const_lex_string
 {
   const char *str;
   size_t length;
 };
 typedef struct st_mysql_const_lex_string MYSQL_CONST_LEX_STRING;
+struct st_mysql_lex_string
+{
+  char *str;
+  size_t length;
+  operator struct st_mysql_const_lex_string() const
+  {
+    return {str, length};
+  }
+};
+typedef struct st_mysql_lex_string MYSQL_LEX_STRING;
 extern struct thd_alloc_service_st {
-  void *(*thd_alloc_func)(THD*, size_t);
-  void *(*thd_calloc_func)(THD*, size_t);
-  char *(*thd_strdup_func)(THD*, const char *);
-  char *(*thd_strmake_func)(THD*, const char *, size_t);
-  void *(*thd_memdup_func)(THD*, const void*, size_t);
-  MYSQL_CONST_LEX_STRING *(*thd_make_lex_string_func)(THD*,
+  void *(*thd_alloc_func)(const THD*, size_t);
+  void *(*thd_calloc_func)(const THD*, size_t);
+  char *(*thd_strdup_func)(const THD*, const char *);
+  char *(*thd_strmake_func)(const THD*, const char *, size_t);
+  void *(*thd_memdup_func)(const THD*, const void*, size_t);
+  MYSQL_CONST_LEX_STRING *(*thd_make_lex_string_func)(const THD*,
                                         MYSQL_CONST_LEX_STRING *,
                                         const char *, size_t, int);
 } *thd_alloc_service;
-void *thd_alloc(THD* thd, size_t size);
-void *thd_calloc(THD* thd, size_t size);
-char *thd_strdup(THD* thd, const char *str);
-char *thd_strmake(THD* thd, const char *str, size_t size);
-void *thd_memdup(THD* thd, const void* str, size_t size);
+void *thd_alloc(const THD* thd, size_t size);
+void *thd_calloc(const THD* thd, size_t size);
+char *thd_strdup(const THD* thd, const char *str);
+char *thd_strmake(const THD* thd, const char *str, size_t size);
+void *thd_memdup(const THD* thd, const void* str, size_t size);
 MYSQL_CONST_LEX_STRING
-*thd_make_lex_string(THD* thd, MYSQL_CONST_LEX_STRING *lex_str,
+*thd_make_lex_string(const THD* thd, MYSQL_CONST_LEX_STRING *lex_str,
                      const char *str, size_t size,
                      int allocate_lex_string);
 }
@@ -487,9 +498,12 @@ extern struct sql_service_st {
   int (STDCALL *mysql_set_character_set_func)(MYSQL *mysql, const char *cs_name);
   unsigned int (STDCALL *mysql_num_fields_func)(MYSQL_RES *res);
   int (STDCALL *mysql_select_db_func)(MYSQL *mysql, const char *db);
+  MYSQL_RES *(STDCALL *mysql_use_result_func)(MYSQL *mysql);
+  MYSQL_FIELD *(STDCALL *mysql_fetch_fields_func)(MYSQL_RES *res);
+  unsigned long (STDCALL *mysql_real_escape_string_func)(MYSQL *mysql, char *to,
+                                        const char *from, unsigned long length);
   my_bool (STDCALL *mysql_ssl_set_func)(MYSQL *mysql, const char *key,
-                                        const char *cert, const char *ca,
-                                        const char *capath, const char *cipher);
+      const char *cert, const char *ca, const char *capath, const char *cipher);
 } *sql_service;
 MYSQL *mysql_real_connect_local(MYSQL *mysql);
 }
diff --git a/include/mysql/plugin_function.h.pp b/include/mysql/plugin_function.h.pp
index afdcb534..1abb2f47 100644
--- a/include/mysql/plugin_function.h.pp
+++ b/include/mysql/plugin_function.h.pp
@@ -57,10 +57,17 @@ static inline int encryption_crypt(const unsigned char* src, unsigned int slen,
 {
   void *ctx= alloca(encryption_handler.encryption_ctx_size_func((key_id),(key_version)));
   int res1, res2;
-  unsigned int d1, d2;
+  unsigned int d1, d2= *dlen;
+  assert(*dlen >= slen);
+  assert((dst[*dlen - 1]= 1));
+  if (src < dst)
+    assert(src + slen <= dst);
+  else
+    assert(dst + *dlen <= src);
   if ((res1= encryption_handler.encryption_ctx_init_func((ctx),(key),(klen),(iv),(ivlen),(flags),(key_id),(key_version))))
     return res1;
   res1= encryption_handler.encryption_ctx_update_func((ctx),(src),(slen),(dst),(&d1));
+  d2-= d1;
   res2= encryption_handler.encryption_ctx_finish_func((ctx),(dst + d1),(&d2));
   *dlen= d1 + d2;
   return res1 ? res1 : res2;
@@ -294,35 +301,39 @@ void my_sha512_input(void *context, const unsigned char *buf, size_t len);
 void my_sha512_result(void *context, unsigned char *digest);
 }
 extern "C" {
-struct st_mysql_lex_string
-{
-  char *str;
-  size_t length;
-};
-typedef struct st_mysql_lex_string MYSQL_LEX_STRING;
 struct st_mysql_const_lex_string
 {
   const char *str;
   size_t length;
 };
 typedef struct st_mysql_const_lex_string MYSQL_CONST_LEX_STRING;
+struct st_mysql_lex_string
+{
+  char *str;
+  size_t length;
+  operator struct st_mysql_const_lex_string() const
+  {
+    return {str, length};
+  }
+};
+typedef struct st_mysql_lex_string MYSQL_LEX_STRING;
 extern struct thd_alloc_service_st {
-  void *(*thd_alloc_func)(THD*, size_t);
-  void *(*thd_calloc_func)(THD*, size_t);
-  char *(*thd_strdup_func)(THD*, const char *);
-  char *(*thd_strmake_func)(THD*, const char *, size_t);
-  void *(*thd_memdup_func)(THD*, const void*, size_t);
-  MYSQL_CONST_LEX_STRING *(*thd_make_lex_string_func)(THD*,
+  void *(*thd_alloc_func)(const THD*, size_t);
+  void *(*thd_calloc_func)(const THD*, size_t);
+  char *(*thd_strdup_func)(const THD*, const char *);
+  char *(*thd_strmake_func)(const THD*, const char *, size_t);
+  void *(*thd_memdup_func)(const THD*, const void*, size_t);
+  MYSQL_CONST_LEX_STRING *(*thd_make_lex_string_func)(const THD*,
                                         MYSQL_CONST_LEX_STRING *,
                                         const char *, size_t, int);
 } *thd_alloc_service;
-void *thd_alloc(THD* thd, size_t size);
-void *thd_calloc(THD* thd, size_t size);
-char *thd_strdup(THD* thd, const char *str);
-char *thd_strmake(THD* thd, const char *str, size_t size);
-void *thd_memdup(THD* thd, const void* str, size_t size);
+void *thd_alloc(const THD* thd, size_t size);
+void *thd_calloc(const THD* thd, size_t size);
+char *thd_strdup(const THD* thd, const char *str);
+char *thd_strmake(const THD* thd, const char *str, size_t size);
+void *thd_memdup(const THD* thd, const void* str, size_t size);
 MYSQL_CONST_LEX_STRING
-*thd_make_lex_string(THD* thd, MYSQL_CONST_LEX_STRING *lex_str,
+*thd_make_lex_string(const THD* thd, MYSQL_CONST_LEX_STRING *lex_str,
                      const char *str, size_t size,
                      int allocate_lex_string);
 }
@@ -487,9 +498,12 @@ extern struct sql_service_st {
   int (STDCALL *mysql_set_character_set_func)(MYSQL *mysql, const char *cs_name);
   unsigned int (STDCALL *mysql_num_fields_func)(MYSQL_RES *res);
   int (STDCALL *mysql_select_db_func)(MYSQL *mysql, const char *db);
+  MYSQL_RES *(STDCALL *mysql_use_result_func)(MYSQL *mysql);
+  MYSQL_FIELD *(STDCALL *mysql_fetch_fields_func)(MYSQL_RES *res);
+  unsigned long (STDCALL *mysql_real_escape_string_func)(MYSQL *mysql, char *to,
+                                        const char *from, unsigned long length);
   my_bool (STDCALL *mysql_ssl_set_func)(MYSQL *mysql, const char *key,
-                                        const char *cert, const char *ca,
-                                        const char *capath, const char *cipher);
+      const char *cert, const char *ca, const char *capath, const char *cipher);
 } *sql_service;
 MYSQL *mysql_real_connect_local(MYSQL *mysql);
 }
diff --git a/include/mysql/plugin_password_validation.h.pp b/include/mysql/plugin_password_validation.h.pp
index 3f238088..1284a3b0 100644
--- a/include/mysql/plugin_password_validation.h.pp
+++ b/include/mysql/plugin_password_validation.h.pp
@@ -57,10 +57,17 @@ static inline int encryption_crypt(const unsigned char* src, unsigned int slen,
 {
   void *ctx= alloca(encryption_handler.encryption_ctx_size_func((key_id),(key_version)));
   int res1, res2;
-  unsigned int d1, d2;
+  unsigned int d1, d2= *dlen;
+  assert(*dlen >= slen);
+  assert((dst[*dlen - 1]= 1));
+  if (src < dst)
+    assert(src + slen <= dst);
+  else
+    assert(dst + *dlen <= src);
   if ((res1= encryption_handler.encryption_ctx_init_func((ctx),(key),(klen),(iv),(ivlen),(flags),(key_id),(key_version))))
     return res1;
   res1= encryption_handler.encryption_ctx_update_func((ctx),(src),(slen),(dst),(&d1));
+  d2-= d1;
   res2= encryption_handler.encryption_ctx_finish_func((ctx),(dst + d1),(&d2));
   *dlen= d1 + d2;
   return res1 ? res1 : res2;
@@ -294,35 +301,39 @@ void my_sha512_input(void *context, const unsigned char *buf, size_t len);
 void my_sha512_result(void *context, unsigned char *digest);
 }
 extern "C" {
-struct st_mysql_lex_string
-{
-  char *str;
-  size_t length;
-};
-typedef struct st_mysql_lex_string MYSQL_LEX_STRING;
 struct st_mysql_const_lex_string
 {
   const char *str;
   size_t length;
 };
 typedef struct st_mysql_const_lex_string MYSQL_CONST_LEX_STRING;
+struct st_mysql_lex_string
+{
+  char *str;
+  size_t length;
+  operator struct st_mysql_const_lex_string() const
+  {
+    return {str, length};
+  }
+};
+typedef struct st_mysql_lex_string MYSQL_LEX_STRING;
 extern struct thd_alloc_service_st {
-  void *(*thd_alloc_func)(THD*, size_t);
-  void *(*thd_calloc_func)(THD*, size_t);
-  char *(*thd_strdup_func)(THD*, const char *);
-  char *(*thd_strmake_func)(THD*, const char *, size_t);
-  void *(*thd_memdup_func)(THD*, const void*, size_t);
-  MYSQL_CONST_LEX_STRING *(*thd_make_lex_string_func)(THD*,
+  void *(*thd_alloc_func)(const THD*, size_t);
+  void *(*thd_calloc_func)(const THD*, size_t);
+  char *(*thd_strdup_func)(const THD*, const char *);
+  char *(*thd_strmake_func)(const THD*, const char *, size_t);
+  void *(*thd_memdup_func)(const THD*, const void*, size_t);
+  MYSQL_CONST_LEX_STRING *(*thd_make_lex_string_func)(const THD*,
                                         MYSQL_CONST_LEX_STRING *,
                                         const char *, size_t, int);
 } *thd_alloc_service;
-void *thd_alloc(THD* thd, size_t size);
-void *thd_calloc(THD* thd, size_t size);
-char *thd_strdup(THD* thd, const char *str);
-char *thd_strmake(THD* thd, const char *str, size_t size);
-void *thd_memdup(THD* thd, const void* str, size_t size);
+void *thd_alloc(const THD* thd, size_t size);
+void *thd_calloc(const THD* thd, size_t size);
+char *thd_strdup(const THD* thd, const char *str);
+char *thd_strmake(const THD* thd, const char *str, size_t size);
+void *thd_memdup(const THD* thd, const void* str, size_t size);
 MYSQL_CONST_LEX_STRING
-*thd_make_lex_string(THD* thd, MYSQL_CONST_LEX_STRING *lex_str,
+*thd_make_lex_string(const THD* thd, MYSQL_CONST_LEX_STRING *lex_str,
                      const char *str, size_t size,
                      int allocate_lex_string);
 }
@@ -487,9 +498,12 @@ extern struct sql_service_st {
   int (STDCALL *mysql_set_character_set_func)(MYSQL *mysql, const char *cs_name);
   unsigned int (STDCALL *mysql_num_fields_func)(MYSQL_RES *res);
   int (STDCALL *mysql_select_db_func)(MYSQL *mysql, const char *db);
+  MYSQL_RES *(STDCALL *mysql_use_result_func)(MYSQL *mysql);
+  MYSQL_FIELD *(STDCALL *mysql_fetch_fields_func)(MYSQL_RES *res);
+  unsigned long (STDCALL *mysql_real_escape_string_func)(MYSQL *mysql, char *to,
+                                        const char *from, unsigned long length);
   my_bool (STDCALL *mysql_ssl_set_func)(MYSQL *mysql, const char *key,
-                                        const char *cert, const char *ca,
-                                        const char *capath, const char *cipher);
+      const char *cert, const char *ca, const char *capath, const char *cipher);
 } *sql_service;
 MYSQL *mysql_real_connect_local(MYSQL *mysql);
 }
diff --git a/include/mysql/service_encryption.h b/include/mysql/service_encryption.h
index 49639407..812b2861 100644
--- a/include/mysql/service_encryption.h
+++ b/include/mysql/service_encryption.h
@@ -36,6 +36,9 @@
 #ifdef __cplusplus
 extern "C" {
 #endif
+#ifndef MYSQL_ABI_CHECK
+#include <assert.h>
+#endif
 
 /* returned from encryption_key_get_latest_version() */
 #define ENCRYPTION_KEY_VERSION_INVALID        (~(unsigned int)0)
@@ -101,6 +104,11 @@ static inline unsigned int encryption_key_version_exists(unsigned int id, unsign
   return encryption_key_get(id, version, NULL, &unused) != ENCRYPTION_KEY_VERSION_INVALID;
 }
 
+/** main entrypoint to perform encryption or decryption
+ * @invariant `src` is valid for `slen`
+ * @invariant `dst` is valid for `*dlen`, `*dlen` is initialized
+ * @invariant `src` and `dst` do not overlap
+ */
 static inline int encryption_crypt(const unsigned char* src, unsigned int slen,
                                    unsigned char* dst, unsigned int* dlen,
                                    const unsigned char* key, unsigned int klen,
@@ -109,11 +117,23 @@ static inline int encryption_crypt(const unsigned char* src, unsigned int slen,
 {
   void *ctx= alloca(encryption_ctx_size(key_id, key_version));
   int res1, res2;
-  unsigned int d1, d2;
+  unsigned int d1, d2= *dlen;
+
+  // Verify dlen is initialized properly. See MDEV-30389
+  assert(*dlen >= slen);
+  assert((dst[*dlen - 1]= 1));
+  // Verify buffers do not overlap
+  if (src < dst)
+    assert(src + slen <= dst);
+  else
+    assert(dst + *dlen <= src);
+
   if ((res1= encryption_ctx_init(ctx, key, klen, iv, ivlen, flags, key_id, key_version)))
     return res1;
   res1= encryption_ctx_update(ctx, src, slen, dst, &d1);
+  d2-= d1;
   res2= encryption_ctx_finish(ctx, dst + d1, &d2);
+
   *dlen= d1 + d2;
   return res1 ? res1 : res2;
 }
@@ -124,4 +144,3 @@ static inline int encryption_crypt(const unsigned char* src, unsigned int slen,
 
 #define MYSQL_SERVICE_ENCRYPTION_INCLUDED
 #endif
-
diff --git a/include/mysql/service_sql.h b/include/mysql/service_sql.h
index e9d1491d..a4a61cc0 100644
--- a/include/mysql/service_sql.h
+++ b/include/mysql/service_sql.h
@@ -68,9 +68,12 @@ extern struct sql_service_st {
   int (STDCALL *mysql_set_character_set_func)(MYSQL *mysql, const char *cs_name);
   unsigned int (STDCALL *mysql_num_fields_func)(MYSQL_RES *res);
   int (STDCALL *mysql_select_db_func)(MYSQL *mysql, const char *db);
+  MYSQL_RES *(STDCALL *mysql_use_result_func)(MYSQL *mysql);
+  MYSQL_FIELD *(STDCALL *mysql_fetch_fields_func)(MYSQL_RES *res);
+  unsigned long (STDCALL *mysql_real_escape_string_func)(MYSQL *mysql, char *to,
+                                        const char *from, unsigned long length);
   my_bool (STDCALL *mysql_ssl_set_func)(MYSQL *mysql, const char *key,
-                                        const char *cert, const char *ca,
-                                        const char *capath, const char *cipher);
+      const char *cert, const char *ca, const char *capath, const char *cipher);
 } *sql_service;
 
 #ifdef MYSQL_DYNAMIC_PLUGIN
@@ -92,7 +95,10 @@ extern struct sql_service_st {
 #define mysql_set_character_set(M,C) sql_service->mysql_set_character_set_func(M,C)
 #define mysql_num_fields(R) sql_service->mysql_num_fields_func(R)
 #define mysql_select_db(M,D) sql_service->mysql_select_db_func(M,D)
-#define mysql_ssl_set(M,K,C,A,P,H) sql_service->mysql_ssl_set_func(M,K,C,A,P,H)
+#define mysql_use_result(M) sql_service->mysql_use_result_func(M)
+#define mysql_fetch_fields(R) sql_service->mysql_fetch_fields_func(R)
+#define mysql_real_escape_string(M,T,F,L) sql_service->mysql_real_escape_string_func(M,T,F,L)
+#define mysql_ssl_set(M,K,C1,C2,C3,C4) sql_service->mysql_ssl_set_func(M,K,C1,C2,C3,C4)
 
 #else
 
diff --git a/include/mysql/service_thd_alloc.h b/include/mysql/service_thd_alloc.h
index 0be4687b..014277b5 100644
--- a/include/mysql/service_thd_alloc.h
+++ b/include/mysql/service_thd_alloc.h
@@ -35,27 +35,34 @@
 extern "C" {
 #endif
 
-struct st_mysql_lex_string
+struct st_mysql_const_lex_string
 {
-  char *str;
+  const char *str;
   size_t length;
 };
-typedef struct st_mysql_lex_string MYSQL_LEX_STRING;
+typedef struct st_mysql_const_lex_string MYSQL_CONST_LEX_STRING;
 
-struct st_mysql_const_lex_string
+struct st_mysql_lex_string
 {
-  const char *str;
+  char *str;
   size_t length;
+#ifdef __cplusplus
+  // Allow automatic cast from LEX_STRING to LEX_CSTRING in c++.
+  operator struct st_mysql_const_lex_string() const
+  {
+    return {str, length};
+  }
+#endif
 };
-typedef struct st_mysql_const_lex_string MYSQL_CONST_LEX_STRING;
+typedef struct st_mysql_lex_string MYSQL_LEX_STRING;
 
 extern struct thd_alloc_service_st {
-  void *(*thd_alloc_func)(MYSQL_THD, size_t);
-  void *(*thd_calloc_func)(MYSQL_THD, size_t);
-  char *(*thd_strdup_func)(MYSQL_THD, const char *);
-  char *(*thd_strmake_func)(MYSQL_THD, const char *, size_t);
-  void *(*thd_memdup_func)(MYSQL_THD, const void*, size_t);
-  MYSQL_CONST_LEX_STRING *(*thd_make_lex_string_func)(MYSQL_THD,
+  void *(*thd_alloc_func)(const MYSQL_THD, size_t);
+  void *(*thd_calloc_func)(const MYSQL_THD, size_t);
+  char *(*thd_strdup_func)(const MYSQL_THD, const char *);
+  char *(*thd_strmake_func)(const MYSQL_THD, const char *, size_t);
+  void *(*thd_memdup_func)(const MYSQL_THD, const void*, size_t);
+  MYSQL_CONST_LEX_STRING *(*thd_make_lex_string_func)(const MYSQL_THD,
                                         MYSQL_CONST_LEX_STRING *,
                                         const char *, size_t, int);
 } *thd_alloc_service;
@@ -92,23 +99,23 @@ extern struct thd_alloc_service_st {
 
   @see alloc_root()
 */
-void *thd_alloc(MYSQL_THD thd, size_t size);
+void *thd_alloc(const MYSQL_THD thd, size_t size);
 /**
   @see thd_alloc()
 */
-void *thd_calloc(MYSQL_THD thd, size_t size);
+void *thd_calloc(const MYSQL_THD thd, size_t size);
 /**
   @see thd_alloc()
 */
-char *thd_strdup(MYSQL_THD thd, const char *str);
+char *thd_strdup(const MYSQL_THD thd, const char *str);
 /**
   @see thd_alloc()
 */
-char *thd_strmake(MYSQL_THD thd, const char *str, size_t size);
+char *thd_strmake(const MYSQL_THD thd, const char *str, size_t size);
 /**
   @see thd_alloc()
 */
-void *thd_memdup(MYSQL_THD thd, const void* str, size_t size);
+void *thd_memdup(const MYSQL_THD thd, const void* str, size_t size);
 
 /**
   Create a LEX_STRING in this connection's local memory pool
@@ -124,7 +131,7 @@ void *thd_memdup(MYSQL_THD thd, const void* str, size_t size);
   @see thd_alloc()
 */
 MYSQL_CONST_LEX_STRING
-*thd_make_lex_string(MYSQL_THD thd, MYSQL_CONST_LEX_STRING *lex_str,
+*thd_make_lex_string(const MYSQL_THD thd, MYSQL_CONST_LEX_STRING *lex_str,
                      const char *str, size_t size,
                      int allocate_lex_string);
 
diff --git a/include/mysql_com.h b/include/mysql_com.h
index 28627e38..a56c3f48 100644
--- a/include/mysql_com.h
+++ b/include/mysql_com.h
@@ -41,27 +41,6 @@
 #define MYSQL50_TABLE_NAME_PREFIX_LENGTH  (sizeof(MYSQL50_TABLE_NAME_PREFIX)-1)
 #define SAFE_NAME_LEN (NAME_LEN + MYSQL50_TABLE_NAME_PREFIX_LENGTH)
 
-/*
-  MDEV-4088
-
-  MySQL (and MariaDB 5.x before the fix) was using the first character of the
-  server version string (as sent in the first handshake protocol packet) to
-  decide on the replication event formats. And for 10.x the first character
-  is "1", which the slave thought comes from some ancient 1.x version
-  (ignoring the fact that the first ever MySQL version was 3.x).
-
-  To support replication to these old clients, we fake the version in the
-  first handshake protocol packet to start from "5.5.5-" (for example,
-  it might be "5.5.5-10.0.1-MariaDB-debug-log".
-
-  On the client side we remove this fake version prefix to restore the
-  correct server version. The version "5.5.5" did not support
-  pluggable authentication, so any version starting from "5.5.5-" and
-  claiming to support pluggable auth, must be using this fake prefix.
-*/
-/* this version must be the one that *does not* support pluggable auth */
-#define RPL_VERSION_HACK "5.5.5-"
-
 #define SERVER_VERSION_LENGTH 60
 #define SQLSTATE_LENGTH 5
 #define LIST_PROCESS_HOST_LEN 64
@@ -739,7 +718,7 @@ void scramble(char *to, const char *message, const char *password);
 my_bool check_scramble(const unsigned char *reply, const char *message,
                        const unsigned char *hash_stage2);
 void get_salt_from_password(unsigned char *res, const char *password);
-char *octet2hex(char *to, const char *str, size_t len);
+char *octet2hex(char *to, const unsigned char *str, size_t len);
 
 /* end of password.c */
 
diff --git a/include/mysys_err.h b/include/mysys_err.h
index e0e97d02..d115b5dd 100644
--- a/include/mysys_err.h
+++ b/include/mysys_err.h
@@ -73,7 +73,8 @@ extern const char *globerrs[];  /* my_error_messages is here */
 #define EE_PERM_LOCK_MEMORY     37
 #define EE_MEMCNTL              38
 #define EE_DUPLICATE_CHARSET    39
-#define EE_ERROR_LAST           39 /* Copy last error nr */
+#define EE_NAME_DEPRECATED      40
+#define EE_ERROR_LAST           40 /* Copy last error nr */
 
 /* Add error numbers before EE_ERROR_LAST and change it accordingly. */
 
diff --git a/include/service_versions.h b/include/service_versions.h
index c8169614..5fcff1e6 100644
--- a/include/service_versions.h
+++ b/include/service_versions.h
@@ -45,7 +45,7 @@
 #define VERSION_json                    0x0100
 #define VERSION_thd_mdl                 0x0100
 #define VERSION_print_check_msg         0x0100
-#define VERSION_sql_service             0x0101
+#define VERSION_sql_service             0x0102
 
 #define VERSION_provider_bzip2          0x0100
 #define VERSION_provider_lz4            0x0100
diff --git a/include/source_revision.h b/include/source_revision.h
index e93bf678..b3b89464 100644
--- a/include/source_revision.h
+++ b/include/source_revision.h
@@ -1 +1 @@
-#define SOURCE_REVISION "3a069644682e336e445039e48baae9693f9a08ee"
+#define SOURCE_REVISION "3fca5ed772fb75e3e57c507edef2985f8eba5b12"
diff --git a/include/sql_common.h b/include/sql_common.h
index 2a79261c..1d33f381 100644
--- a/include/sql_common.h
+++ b/include/sql_common.h
@@ -41,7 +41,7 @@ struct st_mysql_options_extention {
                           uint proc_info_length);
   HASH connection_attributes;
   size_t connection_attributes_length;
-  my_bool tls_verify_server_cert;
+  my_bool tls_allow_invalid_server_cert;
 };
 
 typedef struct st_mysql_methods
diff --git a/include/sslopt-case.h b/include/sslopt-case.h
index 11351247..c0679646 100644
--- a/include/sslopt-case.h
+++ b/include/sslopt-case.h
@@ -24,6 +24,11 @@
     case OPT_SSL_CIPHER:
     case OPT_SSL_CRL:
     case OPT_SSL_CRLPATH:
+    case OPT_TLS_VERSION:
+#ifdef MYSQL_CLIENT
+    case OPT_SSL_FP:
+    case OPT_SSL_FPLIST:
+#endif
     /*
       Enable use of SSL if we are using any ssl option
       One can disable SSL later by using --skip-ssl or --ssl=0
diff --git a/include/sslopt-longopts.h b/include/sslopt-longopts.h
index be3fedd9..38bb89b6 100644
--- a/include/sslopt-longopts.h
+++ b/include/sslopt-longopts.h
@@ -45,16 +45,21 @@
     "Certificate revocation list path (implies --ssl).",
    &opt_ssl_crlpath, &opt_ssl_crlpath, 0, GET_STR, REQUIRED_ARG,
    0, 0, 0, 0, 0, 0},
-  {"tls-version", 0, "TLS protocol version for secure connection.",
+  {"tls-version", OPT_TLS_VERSION,
+   "TLS protocol version for secure connection.",
    &opt_tls_version, &opt_tls_version, 0, GET_STR, REQUIRED_ARG,
    0, 0, 0, 0, 0, 0},
 
 #ifdef MYSQL_CLIENT
+  {"ssl-fp", OPT_SSL_FP, "Server certificate fingerprint (implies --ssl).",
+   &opt_ssl_fp, &opt_ssl_fp, 0, GET_STR, REQUIRED_ARG, 0, 0, 0, 0, 0, 0},
+  {"ssl-fplist", OPT_SSL_FPLIST, "File with accepted server certificate "
+   "fingerprints, one per line (implies --ssl).",
+   &opt_ssl_fplist, &opt_ssl_fplist, 0, GET_STR, REQUIRED_ARG, 0, 0, 0, 0, 0, 0},
   {"ssl-verify-server-cert", 0,
-   "Verify server's \"Common Name\" in its cert against hostname used "
-   "when connecting. This option is disabled by default.",
+   "Verify server's certificate to prevent man-in-the-middle attacks",
    &opt_ssl_verify_server_cert, &opt_ssl_verify_server_cert,
-   0, GET_BOOL, OPT_ARG, 0, 0, 0, 0, 0, 0},
+   0, GET_BOOL, OPT_ARG, 2, 0, 0, 0, 0, 0},
 #endif
 #endif /* HAVE_OPENSSL */
 #endif /* SSLOPT_LONGOPTS_INCLUDED */
diff --git a/include/sslopt-vars.h b/include/sslopt-vars.h
index d263e5db..3a3679a5 100644
--- a/include/sslopt-vars.h
+++ b/include/sslopt-vars.h
@@ -32,7 +32,52 @@ SSL_STATIC char *opt_ssl_crl     = 0;
 SSL_STATIC char *opt_ssl_crlpath = 0;
 SSL_STATIC char *opt_tls_version = 0;
 #ifdef MYSQL_CLIENT
-SSL_STATIC my_bool opt_ssl_verify_server_cert= 0;
+SSL_STATIC char *opt_ssl_fp      = 0;
+SSL_STATIC char *opt_ssl_fplist  = 0;
+SSL_STATIC my_bool opt_ssl_verify_server_cert= 2;
+
+#define SET_SSL_OPTS(M)                                                 \
+  do {                                                                  \
+    if (opt_use_ssl)                                                    \
+    {                                                                   \
+      mysql_ssl_set((M), opt_ssl_key, opt_ssl_cert, opt_ssl_ca,         \
+                    opt_ssl_capath, opt_ssl_cipher);                    \
+      mysql_options((M), MYSQL_OPT_SSL_CRL, opt_ssl_crl);               \
+      mysql_options((M), MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath);       \
+      mysql_options((M), MARIADB_OPT_TLS_VERSION, opt_tls_version);     \
+      mysql_options((M), MARIADB_OPT_TLS_PEER_FP, opt_ssl_fp);          \
+      mysql_options((M), MARIADB_OPT_TLS_PEER_FP_LIST, opt_ssl_fplist); \
+    }                                                                   \
+    else                                                                \
+      opt_ssl_verify_server_cert= 0;                                    \
+    mysql_options((M),MYSQL_OPT_SSL_VERIFY_SERVER_CERT,                 \
+                  &opt_ssl_verify_server_cert);                         \
+  } while(0)
+
+/*
+  let's disable opt_ssl_verify_server_cert if neither CA nor FP and
+  nor password were specified and the protocol is TCP.
+*/
+#define SET_SSL_OPTS_WITH_CHECK(M)                                      \
+  do {                                                                  \
+    if (opt_use_ssl && opt_ssl_verify_server_cert==2 &&                 \
+        !(opt_ssl_ca && opt_ssl_ca[0]) &&                               \
+        !(opt_ssl_capath && opt_ssl_capath[0]) &&                       \
+        !(opt_ssl_fp && opt_ssl_fp[0]) &&                               \
+        !(opt_ssl_fplist && opt_ssl_fplist[0]) &&                       \
+        !(opt_password && opt_password[0]) &&                           \
+        opt_protocol == MYSQL_PROTOCOL_TCP)                             \
+    {                                                                   \
+      fprintf(stderr, "WARNING: option --ssl-verify-server-cert is "    \
+              "disabled, because of an insecure passwordless login.\n");\
+      opt_ssl_verify_server_cert= 0;                                    \
+    }                                                                   \
+    SET_SSL_OPTS(M);                                                    \
+  } while (0)
+
 #endif
+#else
+#define SET_SSL_OPTS(M) do { } while(0)
+#define SET_SSL_OPTS_WITH_CHECK(M) do { } while(0)
 #endif
 #endif /* SSLOPT_VARS_INCLUDED */
diff --git a/include/thr_alarm.h b/include/thr_alarm.h
deleted file mode 100644
index e0f3fdd1..00000000
--- a/include/thr_alarm.h
+++ /dev/null
@@ -1,115 +0,0 @@
-/* Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.
-
-   This program is free software; you can redistribute it and/or modify
-   it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; version 2 of the License.
-
-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-   GNU General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1335  USA */
-
-/* Prototypes when using thr_alarm library functions */
-
-#ifndef _thr_alarm_h
-#define _thr_alarm_h
-#ifdef	__cplusplus
-extern "C" {
-#endif
-
-#ifndef USE_ALARM_THREAD
-#define USE_ONE_SIGNAL_HAND		/* One must call process_alarm */
-#endif
-#ifdef HAVE_rts_threads
-#undef USE_ONE_SIGNAL_HAND
-#define USE_ALARM_THREAD
-#define THR_SERVER_ALARM SIGUSR1
-#else
-#define THR_SERVER_ALARM SIGALRM
-#endif
-
-typedef struct st_alarm_info
-{
-  time_t next_alarm_time;
-  uint active_alarms;
-  uint max_used_alarms;
-} ALARM_INFO;
-
-void thr_alarm_info(ALARM_INFO *info);
-extern my_bool my_disable_thr_alarm;
-
-#ifdef _WIN32
-#define DONT_USE_THR_ALARM
-#endif
-#if defined(DONT_USE_THR_ALARM)
-
-#define USE_ALARM_THREAD
-#undef USE_ONE_SIGNAL_HAND
-
-typedef my_bool thr_alarm_t;
-typedef my_bool ALARM;
-
-#define thr_alarm_init(A) (*(A))=0
-#define thr_alarm_in_use(A) (*(A) != 0)
-#define thr_end_alarm(A)
-#define thr_alarm(A,B,C) ((*(A)=1)-1)
-/* The following should maybe be (*(A)) */
-#define thr_got_alarm(A) 0
-#define init_thr_alarm(A)
-#define thr_alarm_kill(A)
-#define resize_thr_alarm(N)
-#define end_thr_alarm(A)
-
-#else
-#if defined(_WIN32)
-typedef struct st_thr_alarm_entry
-{
-  UINT_PTR crono;
-} thr_alarm_entry;
-
-#else /* System with posix threads */
-
-typedef int thr_alarm_entry;
-
-#define thr_got_alarm(thr_alarm) (**(thr_alarm))
-
-#endif /* _WIN32 */
-
-typedef thr_alarm_entry* thr_alarm_t;
-
-typedef struct st_alarm {
-  time_t expire_time;
-  thr_alarm_entry alarmed;		/* set when alarm is due */
-  pthread_t thread;
-  my_thread_id thread_id;
-  uint index_in_queue;
-  my_bool malloced;
-} ALARM;
-
-extern uint thr_client_alarm;
-extern pthread_t alarm_thread;
-
-#define thr_alarm_init(A) (*(A))=0
-#define thr_alarm_in_use(A) (*(A)!= 0)
-void init_thr_alarm(uint max_alarm);
-void resize_thr_alarm(uint max_alarms);
-my_bool thr_alarm(thr_alarm_t *alarmed, uint sec, ALARM *buff);
-void thr_alarm_kill(my_thread_id thread_id);
-void thr_end_alarm(thr_alarm_t *alarmed);
-void end_thr_alarm(my_bool free_structures);
-sig_handler process_alarm(int);
-#ifndef thr_got_alarm
-my_bool thr_got_alarm(thr_alarm_t *alrm);
-#endif
-
-
-#endif /* DONT_USE_THR_ALARM */
-
-#ifdef	__cplusplus
-}
-#endif /* __cplusplus */
-#endif /* _thr_alarm_h */
diff --git a/include/thr_lock.h b/include/thr_lock.h
index d918d6d7..443d707b 100644
--- a/include/thr_lock.h
+++ b/include/thr_lock.h
@@ -173,8 +173,6 @@ void thr_print_locks(void);		/* For debugging */
 my_bool thr_upgrade_write_delay_lock(THR_LOCK_DATA *data,
                                      enum thr_lock_type new_lock_type,
                                      ulong lock_wait_timeout);
-void    thr_downgrade_write_lock(THR_LOCK_DATA *data,
-                                 enum thr_lock_type new_lock_type);
 my_bool thr_reschedule_write_lock(THR_LOCK_DATA *data,
                                   ulong lock_wait_timeout);
 void thr_set_lock_wait_callback(void (*before_wait)(void),
diff --git a/include/welcome_copyright_notice.h b/include/welcome_copyright_notice.h
index 22d8d204..e50e9a02 100644
--- a/include/welcome_copyright_notice.h
+++ b/include/welcome_copyright_notice.h
@@ -27,4 +27,12 @@
   "Copyright (c) " first_year ", " COPYRIGHT_NOTICE_CURRENT_YEAR \
    ", Oracle, MariaDB Corporation Ab and others.\n"
 
+#ifdef VER
+static inline void print_version()
+{
+  /* NOTE mysql.cc is not using this function! */
+  printf("%s from %s, client %s for %s (%s)\n",
+         my_progname, MYSQL_SERVER_VERSION, VER, SYSTEM_TYPE, MACHINE_TYPE);
+}
+#endif
 #endif /* _welcome_copyright_notice_h_ */