Bug#28986737: RENAMING AND REPLACING MYSQL.USER TABLE CAN LEAD TO A SERVER CRASH

1 files changed, 8 insertions, 0 deletions

diff --git a/sql/sql_acl.cc b/sql/sql_acl.cc
index 5d7f82ff5dd..b916f96300a 100644
--- a/sql/sql_acl.cc
+++ b/sql/sql_acl.cc
@@ -825,6 +825,14 @@ static my_bool acl_load(THD *thd, TABLE_LIST *tables)
     goto end;
 
   table->use_all_columns();
+
+  if (table->s->fields < 13) // number of columns in 3.21
+  {
+    sql_print_error("Fatal error: mysql.user table is damaged or in "
+                    "unsupported 3.20 format.");
+    goto end;
+  }
+
   username_char_length= min(table->field[1]->char_length(), USERNAME_CHAR_LENGTH);
   password_length= table->field[2]->field_length /
     table->field[2]->charset()->mbmaxlen;