Connector/C++ string escaper re-escapes its own output, enabling SQL injection

Utils::escapeString is the escaper behind every identifier and literal that MariaDbDatabaseMetaData interpolates into the information_schema queries it builds. It is implemented on top of sql::mariadb::replace, whose inner loop advances its search cursor by the length of the substitution instead of …

  SQLString& replaceInternal(SQLString& str, const SQLString& _substr, const SQLString &subst)
  {
    size_t pos= 0, prev= 0;
    ...
    while ((pos= real.find(substr, prev)) != std::string::npos)
    {
      real.replace(pos, substr.length(), realSub);
      prev+= realSub.length();
    }