Bug #10668: CREATE USER does not enforce username length limit

  This appears to have just been an oversight -- CREATE USER was not enforcing
  the existing username limitations.

1 files changed, 10 insertions, 1 deletions

diff --git a/sql/sql_acl.cc b/sql/sql_acl.cc
index ae5ea210a47..3735f4403de 100644
--- a/sql/sql_acl.cc
+++ b/sql/sql_acl.cc
@@ -5220,7 +5220,16 @@ bool mysql_create_user(THD *thd, List <LEX_USER> &list)
     {
       result= TRUE;
       continue;
-    }  
+    }
+
+    if (user_name->host.length > HOSTNAME_LENGTH ||
+	user_name->user.length > USERNAME_LENGTH)
+    {
+      append_user(&wrong_users, user_name);
+      result= TRUE;
+      continue;
+    }
+
     /*
       Search all in-memory structures and grant tables
       for a mention of the new user name.