Security Fix: The server crashed if an account with the CREATE ROUTINE privilege but not the EXECUTE privilege attempted to create a stored procedure. (Bug#44798)

Security Fix: The server crashed if an account without the proper privileges attempted to create a stored procedure. (Bug#44658)

Security Fix: Four potential format string vulnerabilities were fixed (discovered by the Veracode code analysis). (Bug#44166)

Incompatible Change: The server can load plugins under the control of startup options. For example, many storage engines can be built in pluggable form and loaded when the server starts. In the following descriptions, plugin_name stands for a plugin name such as innodb.

Previously, plugin options were handled like other boolean options (see Program Option Modifiers). That is, any of these options enabled the plugin:

--plugin_name
--plugin_name=1
--enable-plugin_name

And these options disabled the plugin:

--plugin_name=0
--disable-plugin_name
--skip-plugin_name

However, use of a boolean option for plugin loading did not provide control over what to do if the plugin failed to start properly: Should the server exit, or start with the plugin disabled? The actual behavior has been that the server starts with the plugin disabled, which can be problematic. For example, if InnoDB fails to start, existing InnoDB tables become inaccessible, and attempts to create new InnoDB tables result in tables that use the default storage engine unless the NO_ENGINE_SUBSTITUTION SQL mode has been enabled to cause an error to occur instead.

Now, there is a change in the options used to control plugin loading, such that they have a tristate format:

The values OFF, ON, and FORCE are not case sensitive.

Suppose that CSV and InnoDB have been built as pluggable storage engines and that you want the server to load them at startup, subject to these conditions: The server is allowed to run if CSV initialization fails, but must require that InnoDB initialization succeed. To accomplish that, use these lines in an option file:

[mysqld]
csv=ON
innodb=FORCE

This change is incompatible with the previous implementation if you used options of the form --plugin_name=0 or --plugin_name=1, which should be changed to --plugin_name=OFF or --plugin_name=ON, respectively.

--enable-plugin_name is still supported and is the same as --plugin_name=ON. --disable-plugin_name and --skip-plugin_name are still supported and are the same as --plugin_name=OFF. (Bug#19027)

See also Bug#45336.