Read past end of buffer. in `ColumnCountPayload`

[trejjam]

Software versions
MySqlConnector version: 2.3.1
Server type (MySQL, MariaDB, Aurora, etc.) and version: 10.6.5-MariaDB-1:10.6.5+maria~stretch
.NET version: 7.0
ORM: EntityFramework 7.0.14

Describe the bug
The server indicates the MariaDbCacheMetadata capability.

(MySqlConnector.Protocol.Payloads.ColumnCountPayload.Create() is called with the following arguments new [1] { 2 }.AsSpan(), true. The first parameter is sent as new [1] { 1, 1 }.AsSpan() which works fine.

var reader = new ByteArrayReader(span);
var columnCount = (int) reader.ReadLengthEncodedInteger();

// since `supportsOptionalMetadata is false` `reader.ReadByte()` is evaluated which causes the exception
var metadataFollows = !supportsOptionalMetadata || reader.ReadByte() == 1;
return new ColumnCountPayload(columnCount, metadataFollows);

Exception
System.InvalidOperationException
Read past end of buffer.

System.InvalidOperationException: Read past end of buffer.
  File "/_/src/MySqlConnector/Protocol/Serialization/ByteArrayReader.cs", line 158, col 4, in void ByteArrayReader.VerifyRead(int length)
  File "/_/src/MySqlConnector/Protocol/Serialization/ByteArrayReader.cs", line 22, col 3, in byte ByteArrayReader.ReadByte()
  File "/_/src/MySqlConnector/Protocol/Payloads/ColumnCountPayload.cs", line 24, col 3, in ColumnCountPayload ColumnCountPayload.Create(ReadOnlySpan<byte> span, bool supportsOptionalMetadata)
  File "/_/src/MySqlConnector/Core/ResultSet.cs", line 117, col 6, in async Task ResultSet.ReadResultSetHeaderAsync(IOBehavior ioBehavior)
MySqlConnector.MySqlException: Failed to read the result set.
  File "/_/src/MySqlConnector/MySqlDataReader.cs", line 133, col 4, in void MySqlDataReader.ActivateResultSet(CancellationToken cancellationToken)
  File "/_/src/MySqlConnector/MySqlDataReader.cs", line 487, col 4, in async Task MySqlDataReader.InitAsync(CommandListPosition commandListPosition, ICommandPayloadCreator payloadCreator, IDictionary<string, CachedProcedure> cachedProcedures, IMySqlCommand command, CommandBehavior behavior, Activity activity, IOBehavior io...
  File "/_/src/MySqlConnector/Core/CommandExecutor.cs", line 56, col 5, in async Task<MySqlDataReader> CommandExecutor.ExecuteReaderAsync(IReadOnlyList<IMySqlCommand> commands, ICommandPayloadCreator payloadCreator, CommandBehavior behavior, Activity activity, IOBehavior ioBehavior, CancellationToken cancellationToken)
  File "/_/src/MySqlConnector/MySqlCommand.cs", line 345, col 3, in async Task<MySqlDataReader> MySqlCommand.ExecuteReaderAsync(CommandBehavior behavior, IOBehavior ioBehavior, CancellationToken cancellationToken)
  File "/_/src/MySqlConnector/MySqlCommand.cs", line 279, col 3, in DbDataReader MySqlCommand.ExecuteDbDataReader(CommandBehavior behavior)
  File "RelationalCommand.cs", line 533, in RelationalDataReader RelationalCommand.ExecuteReader(RelationalCommandParameterObject parameterObject)
    reader = interceptionResult.HasResult
  File "SingleQueryingEnumerable.cs", line 240, in bool Enumerator.InitializeReader(Enumerator enumerator)
    var dataReader = enumerator._dataReader = relationalCommand.ExecuteReader(
  File "SingleQueryingEnumerable.cs", line 168, in bool Enumerator.MoveNext()+(DbContext _, Enumerator enumerator) => { }
    this, static (_, enumerator) => InitializeReader(enumerator), null);
  ?, in TResult MySqlExecutionStrategy.Execute<TState, TResult>(TState state, Func<DbContext, TState, TResult> operation, Func<DbContext, TState, ExecutionResult<TResult>> verifySucceeded)
  File "SingleQueryingEnumerable.cs", line 167, in bool Enumerator.MoveNext()
    _relationalQueryContext.ExecutionStrategy.Execute(

Code sample

Execute query:

SELECT `MigrationId`, `ProductVersion`
FROM `__EFMigrationsHistory`
ORDER BY `MigrationId`;

Expected behavior
Do not throw an exception.

Additional context
I tried several servers and only one suffers with this. Even the same Mariadb version running in a docker works.

I do not know Mariadb protocol internals.

The issue appears with 2.3.0-beta.2. 2.3.0-beta.1 work fine.

[trejjam]

I am open to sending a PR with a fix (when someone points me to the desired solution)

[bgrainger]

This probably a result of #1301 (which was introduced in 2.3.0 Beta 2).

Are you able to capture an unencrypted packet capture for the failing server? (e.g, by disabling SSL and using tcpdump)

[trejjam]

I believe I wrote a fix, but I will try to catch the communication with Wireshark

[bgrainger]

Fixed by #1399

[bgrainger]

Fixed in 2.3.2.