Sql acl handshake oob read

[jmestwa-coder]

Summary

Fix an out-of-bounds read in parse_client_handshake_packet when handling truncated authentication packets.

Problem

If the username terminator is the last byte in the packet, passwd can reach the end of the packet buffer.
The code then dereferences *passwd before checking bounds, leading to a potential out-of-bounds read.

Fix

Add a boundary check before the dereference:

• Return packet_error if passwd is at or beyond the packet buffer end

Impact

• No change for valid packets
• Malformed packets now fail safely instead of reading past the buffer

Testing

Existing tests cover malformed authentication flows but not this exact boundary case.
Happy to add a regression test if there’s a recommended way to express it.

[gkodinov]

Thank you for your contribution. This is a preliminary review.

Would you consider describing the problem and a sequence of actions that lead to it?
Preferably there should be a regression test for it.

[gkodinov]

This check, if it needs to be done, needs to be done after assigning passwd. Or, maybe, instead of doing this check, how about constraining strend to never go out of buffer? Well, IMHO you do not even need to do that: higher level code ensures that all packages are actually null-terminated iirc.

Which brings me to my next question: do you have a test to demonstrate the problem?

If you can't hit this by fuzzing the network data (as I suppose you wouldn't be able to), then convert this into an assert to make sure the packet is properly terminated.

[jmestwa-coder]

You’re right that the packet buffer is guaranteed to be null-terminated by higher-level code so it’s hard to demonstrate this as a real runtime issue.

I’ve updated the change to use a DBUG_ASSERT instead, to document and enforce the assumption that passwd stays within the packet bounds.