Add NULL terminator to mysql_clear_password. Fixes #703

mysql-net · Sep 25, 2019 · dc3b75c · dc3b75c
1 parent c28126e
commit dc3b75c
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/src/MySqlConnector/Core/ServerSession.cs b/src/MySqlConnector/Core/ServerSession.cs
@@ -538,7 +538,10 @@ private async Task<PayloadData> SwitchAuthenticationAsync(ConnectionSettings cs,
 					Log.Error("Session{0} needs a secure connection to use AuthenticationMethod '{1}'", m_logArguments);
 					throw new MySqlException(MySqlErrorCode.UnableToConnectToHost, "Authentication method '{0}' requires a secure connection.".FormatInvariant(switchRequest.Name));
 				}
-				payload = new PayloadData(Encoding.UTF8.GetBytes(cs.Password));
+				// send the password as a NULL-terminated UTF-8 string
+				var passwordBytes = Encoding.UTF8.GetBytes(cs.Password);
+				Array.Resize(ref passwordBytes, passwordBytes.Length + 1);
+				payload = new PayloadData(passwordBytes);
 				await SendReplyAsync(payload, ioBehavior, cancellationToken).ConfigureAwait(false);
 				return await ReceiveReplyAsync(ioBehavior, cancellationToken).ConfigureAwait(false);