Reject truncated length-encoded integers in MySQL reply parser

src/brpc/policy/mysql/mysql.cpp

@@ -457,13 +457,21 @@ void MysqlResponse::Swap(MysqlResponse* other) {
 ParseError MysqlResponse::ConsumePartialIOBuf(butil::IOBuf& buf,
                                               bool is_auth,
                                               MysqlStmtType stmt_type) {
+    return ConsumePartialIOBuf(buf, is_auth, stmt_type, true);
+}
+
+ParseError MysqlResponse::ConsumePartialIOBuf(butil::IOBuf& buf,
+                                              bool is_auth,
+                                              MysqlStmtType stmt_type,
+                                              bool protocol41) {
     bool more_results = true;
     size_t oldsize = 0;
     while (more_results) {
         oldsize = buf.size();
         if (reply_size() == 0) {
             ParseError err =
-                _first_reply.ConsumePartialIOBuf(buf, &_arena, is_auth, stmt_type, &more_results);
+                _first_reply.ConsumePartialIOBuf(
+                    buf, &_arena, is_auth, stmt_type, &more_results, protocol41);
             if (err != PARSE_OK) {
                 return err;
             }
@@ -484,7 +492,7 @@ ParseError MysqlResponse::ConsumePartialIOBuf(butil::IOBuf& buf,
                 }
             }
             ParseError err = _other_replies[_nreply - 1]->ConsumePartialIOBuf(
-                buf, &_arena, is_auth, stmt_type, &more_results);
+                buf, &_arena, is_auth, stmt_type, &more_results, protocol41);
             if (err != PARSE_OK) {
                 return err;
             }

src/brpc/policy/mysql/mysql.h

@@ -198,7 +198,13 @@ class MysqlResponse : public NonreflectableMessage<MysqlResponse> {
     // Returns PARSE_ERROR_NOT_ENOUGH_DATA if data in `buf' is not enough to parse.
     // Returns PARSE_ERROR_ABSOLUTELY_WRONG if the parsing
     // failed.
+    // Legacy signature kept for binary compatibility with prebuilt clients;
+    // assumes the protocol-4.1 ERR layout.
     ParseError ConsumePartialIOBuf(butil::IOBuf& buf, bool is_auth, MysqlStmtType stmt_type);
+    ParseError ConsumePartialIOBuf(butil::IOBuf& buf,
+                                   bool is_auth,
+                                   MysqlStmtType stmt_type,
+                                   bool protocol41);
 
     // Number of replies in this response.
     // (May have more than one reply due to pipeline)

src/brpc/policy/mysql/mysql_protocol.cpp

@@ -362,7 +362,17 @@ ParseResult ParseMysqlMessage(butil::IOBuf* source,
     }
 
     MysqlStmtType stmt_type = static_cast<MysqlStmtType>(pi.count);
-    ParseError err = msg->response.ConsumePartialIOBuf(*source, pi.auth_flags != 0, stmt_type);
+    // ERR-packet layout: once the client has sent its HandshakeResponse41
+    // (which carries CLIENT_PROTOCOL_41), or in the command phase, errors
+    // include '#' + sql_state. Before that -- an ERR replacing the server
+    // greeting, e.g. "Too many connections" on a saturated server -- the
+    // message follows the error code directly (pre-4.1 layout). The
+    // per-connection AuthContext group is set as soon as the greeting has
+    // been processed, so an empty group means we are still waiting for it.
+    const bool protocol41 = !pi.auth_flags ||
+        (socket->auth_context() != nullptr && !socket->auth_context()->group().empty());
+    ParseError err =
+        msg->response.ConsumePartialIOBuf(*source, pi.auth_flags != 0, stmt_type, protocol41);
     if (FLAGS_mysql_verbose) {
         LOG(INFO) << "[MYSQL PARSE] " << msg->response;
     }