MDEV-40644: Slave SQL Thread Overflow on Malformed Table_map_log_event

[bnestere]

** This will actually go into 10.11, but the work I did was on 10.6, so let's do the review on 10.6 and I'll just push it to 10.11**

A slave can crash when its master sends a Table_map event whose table
name is longer than an identifier can be. The SQL thread applying the
event copies the name into a fixed buffer and overruns it, and the SQL
thread crashes.

A Table_map event carries its database and table names each behind a
one-byte length. The constructor that parses the event sizes a buffer
for each name from its declared length, and do_apply_event() copies
both names out of the event into NAME_LEN+1 byte buffers with strmov().
strmov() copies up to the terminating null. A real identifier is at
most NAME_LEN bytes, so the name fits the buffer and carries that null.

The constructor never bounded the two lengths. Each length is read as a
byte, so each can reach 255. The constructor copied each name with
strncpy() over the declared length, which writes no terminating null
when the source holds none. do_apply_event() then copied the name into
its NAME_LEN+1 byte buffer with strmov(), which ran past the buffer
until it reached a null elsewhere in the heap. pack_info() read the
same names with %s for SHOW RELAYLOG EVENTS, past the buffer in the
same way.

Bound the lengths in the constructor. It now rejects a Table_map event
whose declared database name, or whose declared table name, exceeds
NAME_LEN, before it sizes the name buffers, so is_valid() returns
false. It also terminates each name it copies, so a source that holds
no null does not leave the name unterminated. A master naming a table
with an oversized name now stops the slave's SQL thread with
ER_SLAVE_RELAY_LOG_READ_FAILURE instead of crashing it.

This PR is organized as follows. The first commit shows the regression, and
the second commit contains the fix.

[knielsen]

Brandon Nesterenko ***@***.***> writes:

A slave can crash when its master sends a Table_map event whose table name is longer than an identifier can be. The SQL thread applying the event copies the name into a fixed buffer and overruns it, and the SQL thread crashes.

Looks fine Brandon, thanks! Reviewed-by: Kristian Nielsen ***@***.***>