MDEV-39219: buffer overflow in PROXY protocol v1 header parsing

[uwezkhan]

This fixes a buffer overflow issue in the PROXY protocol v1 header parsing.

The loop that reads the header could fill the entire buffer and then add a null terminator past the boundary, which leads to an off-by-one overflow.

I updated the loop condition to make sure there is always space left for the null terminator.

Also added a small check to handle cases where the connection closes early, so we don’t process incomplete data.

This change does not affect normal behavior, it just makes the parsing safer.

[CLAassistant]

All committers have signed the CLA.

[gkodinov]

Thank you for your contribution! This is a preliminary review.

First of all: sign the CLA please: either pick BSD or MariaCLA.

Secondly: Please add a commit message to your commit that's compliant with MariaDB coding standards.

Thirdly: This is a bug. Find the lowest SUPPORTED version this is in and target that instead of main. I'd say 10.11.

And, last but not least: please add a test! There are regression tests for the proxy protocol. Extend these.

[uwezkhan]

Thanks for the review and guidance!

I’ve updated the patch to:

• use correct read semantics (pos += len)
• ensure safe buffer handling with full header support
• handle connection close safely during read

I’ve also added and registered a regression test for maximum header length in mysql_client_test.c.

Please let me know if anything else needs adjustment.

[vaintroub]

There is a (arguably incorrect) error message from GCC
/home/buildbot/tests/mysql_client_test.c:20764:3: error: ISO C90 forbids mixed declarations and code [-Werror=declaration-after-statement]
20764 | const char *prefix = "PROXY TCP4 1.2.3.4 5.6.7.8 1234 5678";

eventhough we compile with C99, it still throughs this "ISO C90" warning, which turns to error in Linux debug compilation. Anyway, can you move that variable declaration at the start of the block, to fix the GCC.

[uwezkhan]

Thanks for pointing that out.

I’ve moved the variable declarations to the beginning of the function to comply with the C90-style requirement and avoid the GCC warning.

I’ve pushed the updated patch.

[gkodinov]

Thanks for working on this. I'll leave the finer points to the final reviewer.

Please:

• squash your commit into a single one
• rebase on 10.11
• Add a commit message to your commit that's compliant with the mariadb coding standards.

[gkodinov]

There was no reply to my preliminary review from couple of weeks ago. Moving this to "draft" state. Please move back to "open" when/if you intend to keep working on it.

[uwezkhan]

I recreated this PR on top of 10.11 with the commits squashed into a single commit and a MariaDB-compliant commit message.

Updated PR: #4998

Closing this one in favor of the updated version.