MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths

Summary MariaDB Connector/J narrowed 8-byte length-encoded integers received from the server to int without validation. A rogue or MitM server can send a value above Integer.MAXVALUE whose truncation becomes a negative or arbitrary length. Details The protocol encodes lengths as length-encoded...