Pre-authentication `size_t` integer underflow → out-of-bounds read / server crash in MariaDB `caching_sha2_password` (auth_mysql_sha2) via an RSA-OAEP

Summary The `caching_sha2_password` server plugin, on a plaintext TCP connection, RSA-decrypts the client's password reply and sets `pkt_len = (int)plain_text_len` without checking for an empty plaintext. It then calls `sha256_crypt_r(pkt, pkt_len - 1, ...)` where the second parameter is `size_t`. …

unsigned char plain_text[1025];
size_t plain_text_len = sizeof(plain_text) - 1;
...
if (vio_info.protocol == MYSQL_VIO_TCP && !vio_info.tls) {     // plaintext TCP + RSA keys
    ...                                                        // (server serves public key on request '\2')
    if …