• unknown's avatar
    Bug#28984: crasher on connect with out of range password length in \ · 46085513
    unknown authored
    	protocol
    
    Update for function moved to new file in 5.1.
    
    One could send a malformed packet that caused the server to SEGV.  In 
    recent versions of the password protocol, the client tells the server 
    what length the ciphertext is (almost always 20).  If that length was
    large enough to overflow a signed char, then the number would jump to 
    very large after being casted to unsigned int.
      
    Instead, cast the *passwd char to uchar.
    
    
    sql/sql_connect.cc:
      Update for function moved to new file in 5.1.
    46085513
sql_connect.cc 33.3 KB