Merge branch 'bb-10.6-release' into 10.11

Author: sanja-byelkin

mysql-test/main/empty_user_table.result mysql-test/main/bad_user_table.resultmysql-test/main/empty_user_table.result renamed to mysql-test/main/bad_user_table.result

@@ -1,3 +1,6 @@
+#
+# MDEV-4462 mysqld gets SIGFPE when mysql.user table is empty
+#
 create table t1 as select * from mysql.global_priv;
 truncate table mysql.global_priv;
 flush privileges;
@@ -14,3 +17,14 @@ connect(localhost,u1,,test,MASTER_PORT,MASTER_SOCKET);
 connect  fail,localhost,u1;
 Got one of the listed errors
 # switching back from mysql.user to mysql.global_priv
+#
+# MDEV-39266 Stack Overflow via alloca() in Privilege Table JSON Parser
+#
+INSERT INTO mysql.global_priv (Host, User, Priv) VALUES
+('localhost', 'MDEV-39266', CONCAT(
+'{"access":0,"plugin":"mysql_native_password","authentication_string":"',
+REPEAT('X', 400000),
+'","password_last_changed":0}'));
+FLUSH PRIVILEGES;
+DROP USER `MDEV-39266`@localhost;
+# End if 10.6 tests

mysql-test/main/empty_user_table.test mysql-test/main/bad_user_table.testmysql-test/main/empty_user_table.test renamed to mysql-test/main/bad_user_table.test

@@ -1,9 +1,9 @@
-#
-# MDEV-4462 mysqld gets SIGFPE when mysql.user table is empty
-#
-
 source include/not_embedded.inc;
 
+--echo #
+--echo # MDEV-4462 mysqld gets SIGFPE when mysql.user table is empty
+--echo #
+
 create table t1 as select * from mysql.global_priv;
 truncate table mysql.global_priv;
 flush privileges;
@@ -34,3 +34,17 @@ flush privileges;
 connect (fail,localhost,u1);
 
 source include/switch_to_mysql_global_priv.inc;
+
+--echo #
+--echo # MDEV-39266 Stack Overflow via alloca() in Privilege Table JSON Parser
+--echo #
+
+INSERT INTO mysql.global_priv (Host, User, Priv) VALUES
+('localhost', 'MDEV-39266', CONCAT(
+  '{"access":0,"plugin":"mysql_native_password","authentication_string":"',
+  REPEAT('X', 400000),
+  '","password_last_changed":0}'));
+FLUSH PRIVILEGES;
+DROP USER `MDEV-39266`@localhost;
+
+--echo # End if 10.6 tests

sql/sql_acl.cc

@@ -1776,17 +1776,17 @@ class User_table_json: public User_table
     const char *value_start;
     if (get_value(key, JSV_STRING, &value_start, &value_len))
       return "";
-    char *ptr= (char*)alloca(value_len);
+    char *ptr= (char*)my_safe_alloca(value_len);
     if (!ptr)
       return NULL;
     int len= json_unescape(m_table->field[2]->charset(),
                            (const uchar*)value_start,
                            (const uchar*)value_start + value_len,
                            system_charset_info,
                            (uchar*)ptr, (uchar*)ptr + value_len);
-    if (len < 0)
-      return NULL;
-    return strmake_root(root, ptr, len);
+    const char *js= len < 0 ? NULL : strmake_root(root, ptr, len);
+    my_safe_afree(ptr, value_len);
+    return js;
   }
   longlong get_int_value(const char *key, longlong def_val= 0) const
   {