Bug #17351732 MYSQL_CHANGE_USER() API RETURNS ERROR

Igor Solodovnikov · Igor Solodovnikov · commit c646e4a57ad6 · 2013-09-19T02:27:49.000+03:00
UNKNOWN DATABASE 'MYSQL_NATIVE_PASSWORD'

Malformed packed was created in send_client_reply_packet()
due to wrong handling of CLIENT_CONNECT_WITH_DB flag.
Fixed problem in mysql_change_user()'s handling of mysql
handle which could lead to free()ing static string literal.
diff --git a/libmysql/libmysql.c b/libmysql/libmysql.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2000, 2012, Oracle and/or its affiliates. All rights reserved.
+/* Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -357,10 +357,13 @@ my_bool	STDCALL mysql_change_user(MYSQL *mysql, const char *user,
     DBUG_RETURN(TRUE);
   }
 
-  /* Use an empty string instead of NULL. */
-
-  mysql->user= (char*)(user ? user : "");
-  mysql->passwd= (char*)(passwd ? passwd : "");
+  /*
+    Use an empty string instead of NULL.
+    Alloc user and password on heap because mysql_reconnect()
+    calls mysql_close() on success.
+  */
+  mysql->user= my_strdup(user ? user : "", MYF(MY_WME));
+  mysql->passwd= my_strdup(passwd ? passwd : "", MYF(MY_WME));
   mysql->db= 0;
 
   rc= run_plugin_auth(mysql, 0, 0, 0, db);
@@ -378,12 +381,16 @@ my_bool	STDCALL mysql_change_user(MYSQL *mysql, const char *user,
     my_free(saved_db);
 
     /* alloc new connect information */
-    mysql->user= my_strdup(mysql->user, MYF(MY_WME));
-    mysql->passwd= my_strdup(mysql->passwd, MYF(MY_WME));
     mysql->db= db ? my_strdup(db, MYF(MY_WME)) : 0;
   }
   else
   {
+    /* Free temporary connect information */
+    my_free(mysql->user);
+    my_free(mysql->passwd);
+    my_free(mysql->db);
+
+    /* Restore saved state */
     mysql->charset= saved_cs;
     mysql->user= saved_user;
     mysql->passwd= saved_passwd;
diff --git a/sql-common/client.c b/sql-common/client.c
@@ -2591,6 +2591,8 @@ static int send_client_reply_packet(MCPVIO_EXT *mpvio,
 #endif /* HAVE_OPENSSL && !EMBEDDED_LIBRARY*/
   if (mpvio->db)
     mysql->client_flag|= CLIENT_CONNECT_WITH_DB;
+  else
+    mysql->client_flag&= ~CLIENT_CONNECT_WITH_DB;
 
   /* Remove options that server doesn't support */
   mysql->client_flag= mysql->client_flag &
