Bug#28986737: RENAMING AND REPLACING MYSQL.USER TABLE CAN LEAD TO A S…

…ERVER CRASH

mysql-test/r/grant4.result

@@ -132,3 +132,10 @@ flush privileges;
 ERROR 42S02: Table 'mysql.user' doesn't exist
 drop temporary table mysql.user;
 rename table mysql.user1 to mysql.user;
+call mtr.add_suppression('mysql.user table is damaged');
+rename table mysql.user to mysql.user1;
+create table mysql.user (Host char(100), User char(100));
+flush privileges;
+ERROR HY000: Unknown error
+drop table mysql.user;
+rename table mysql.user1 to mysql.user;

mysql-test/t/grant4.test

@@ -159,3 +159,14 @@ create temporary table mysql.user select * from mysql.user1 limit 0;
 flush privileges;
 drop temporary table mysql.user;
 rename table mysql.user1 to mysql.user;
+
+#
+# Bug#28986737: RENAMING AND REPLACING MYSQL.USER TABLE CAN LEAD TO A SERVER CRASH
+#
+call mtr.add_suppression('mysql.user table is damaged');
+rename table mysql.user to mysql.user1;
+create table mysql.user (Host char(100), User char(100));
+--error ER_UNKNOWN_ERROR
+flush privileges;
+drop table mysql.user;
+rename table mysql.user1 to mysql.user;

sql/sql_acl.cc

@@ -825,6 +825,14 @@ static my_bool acl_load(THD *thd, TABLE_LIST *tables)
     goto end;
 
   table->use_all_columns();
+
+  if (table->s->fields < 13) // number of columns in 3.21
+  {
+    sql_print_error("Fatal error: mysql.user table is damaged or in "
+                    "unsupported 3.20 format.");
+    goto end;
+  }
+
   username_char_length= min(table->field[1]->char_length(), USERNAME_CHAR_LENGTH);
   password_length= table->field[2]->field_length /
     table->field[2]->charset()->mbmaxlen;