Bug#43748: crash when non-super user tries to kill the replication threads

manual merge. also adds test specific to 5.1+

mysql-test/suite/rpl/r/rpl_temporary.result:
  show that a non-privileged user trying to
  kill system-threads no longer crashes the
  server. test in 5.1+ only.
mysql-test/suite/rpl/t/rpl_temporary.test:
  show that a non-privileged user trying to
  kill system-threads no longer crashes the
  server. test in 5.1+ only.
sql/sql_class.cc:
  manual merge
sql/sql_class.h:
  manual merge
sql/sql_parse.cc:
  manual merge

3 files changed, 28 insertions, 1 deletions

diff --git a/sql/sql_class.cc b/sql/sql_class.cc
index 945a0484068..4f92d3aea10 100644
--- a/sql/sql_class.cc
+++ b/sql/sql_class.cc
@@ -2805,6 +2805,14 @@ Security_context::restore_security_context(THD *thd,
 }
 #endif
 
+
+bool Security_context::user_matches(Security_context *them)
+{
+  return ((user != NULL) && (them->user != NULL) &&
+          !strcmp(user, them->user));
+}
+
+
 /****************************************************************************
   Handling of open and locked tables states.
 
diff --git a/sql/sql_class.h b/sql/sql_class.h
index 304937101c4..148e4b86e9e 100644
--- a/sql/sql_class.h
+++ b/sql/sql_class.h
@@ -813,6 +813,7 @@ public:
   void
   restore_security_context(THD *thd, Security_context *backup);
 #endif
+  bool user_matches(Security_context *);
 };
 
 
diff --git a/sql/sql_parse.cc b/sql/sql_parse.cc
index 94725b1b53f..d1296c4127d 100644
--- a/sql/sql_parse.cc
+++ b/sql/sql_parse.cc
@@ -6890,8 +6890,26 @@ uint kill_one_thread(THD *thd, ulong id, bool only_kill_query)
   VOID(pthread_mutex_unlock(&LOCK_thread_count));
   if (tmp)
   {
+
+    /*
+      If we're SUPER, we can KILL anything, including system-threads.
+      No further checks.
+
+      KILLer: thd->security_ctx->user could in theory be NULL while
+      we're still in "unauthenticated" state. This is a theoretical
+      case (the code suggests this could happen, so we play it safe).
+
+      KILLee: tmp->security_ctx->user will be NULL for system threads.
+      We need to check so Jane Random User doesn't crash the server
+      when trying to kill a) system threads or b) unauthenticated users'
+      threads (Bug#43748).
+
+      If user of both killer and killee are non-NULL, proceed with
+      slayage if both are string-equal.
+    */
+
     if ((thd->security_ctx->master_access & SUPER_ACL) ||
-	!strcmp(thd->security_ctx->user, tmp->security_ctx->user))
+        thd->security_ctx->user_matches(tmp->security_ctx))
     {
       tmp->awake(only_kill_query ? THD::KILL_QUERY : THD::KILL_CONNECTION);
       error=0;