MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets

Summary MariaDB Connector/J sized heap allocations from lengths declared by the server in OK packets before checking that those lengths fit in the packet. A rogue or MitM server can make the client allocate megabytes from a packet of a few bytes. Details When CLIENTSESSIONTRACK is negotiated the...