From 2ef567175c140d11ae27dc5eef5ef7ee3f340c50 Mon Sep 17 00:00:00 2001
From: Vladislav Vaintroub <vvaintroub@gmail.com>
Date: Mon, 6 Jul 2026 16:08:50 +0200
Subject: [PATCH] MDEV-40141 PAM authentication fails when started with
 --default-auth=dialog

The pam plugin reused the client's initial reply as the password when its
first byte was non-zero, but with --default-auth=dialog that reply is empty
and the byte is stale buffer data. Check the reply length too.
---
 mysql-test/suite/plugins/r/pam.result    | 6 ++++++
 mysql-test/suite/plugins/r/pam_v1.result | 6 ++++++
 mysql-test/suite/plugins/t/pam.test      | 8 ++++++++
 mysql-test/suite/plugins/t/pam_v1.test   | 8 ++++++++
 plugin/auth_pam/auth_pam.c               | 2 +-
 plugin/auth_pam/auth_pam_v1.c            | 2 +-
 6 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/mysql-test/suite/plugins/r/pam.result b/mysql-test/suite/plugins/r/pam.result
index 7b578fa852642..158140453b657 100644
--- a/mysql-test/suite/plugins/r/pam.result
+++ b/mysql-test/suite/plugins/r/pam.result
@@ -16,6 +16,12 @@ select user(), current_user(), database();
 user()	current_user()	database()
 test_pam@localhost	pam_test@%	test
 #
+# MDEV-40141 PAM authentication fails when started with --default-auth=dialog
+#
+[mariadb] Now, the magic number!
+PIN: user()	current_user()
+test_pam@localhost	pam_test@%
+#
 # athentication is unsuccessful
 #
 Challenge input first.
diff --git a/mysql-test/suite/plugins/r/pam_v1.result b/mysql-test/suite/plugins/r/pam_v1.result
index c90d17188d61a..4eb6c31cd7739 100644
--- a/mysql-test/suite/plugins/r/pam_v1.result
+++ b/mysql-test/suite/plugins/r/pam_v1.result
@@ -16,6 +16,12 @@ select user(), current_user(), database();
 user()	current_user()	database()
 test_pam@localhost	pam_test@%	test
 #
+# MDEV-40141 PAM authentication fails when started with --default-auth=dialog
+#
+[mariadb] Now, the magic number!
+PIN: user()	current_user()
+test_pam@localhost	pam_test@%
+#
 # athentication is unsuccessful
 #
 Challenge input first.
diff --git a/mysql-test/suite/plugins/t/pam.test b/mysql-test/suite/plugins/t/pam.test
index c953e05fa684c..9989b99b6c87b 100644
--- a/mysql-test/suite/plugins/t/pam.test
+++ b/mysql-test/suite/plugins/t/pam.test
@@ -1,4 +1,7 @@
 let $PAM_PLUGIN_VERSION= $AUTH_PAM_SO;
+if (!$DIALOG_SO) {
+  skip No dialog client plugin;
+}
 --source pam_init.inc
 
 --write_file $MYSQLTEST_VARDIR/tmp/pam_good.txt
@@ -30,6 +33,11 @@ EOF
 --echo #
 --exec $MYSQL_TEST -u test_pam < $MYSQLTEST_VARDIR/tmp/pam_good.txt
 
+--echo #
+--echo # MDEV-40141 PAM authentication fails when started with --default-auth=dialog
+--echo #
+--exec echo 106 | $MYSQL --default-auth=dialog -u test_pam -psecret -e "select user(), current_user()" test
+
 --echo #
 --echo # athentication is unsuccessful
 --echo #
diff --git a/mysql-test/suite/plugins/t/pam_v1.test b/mysql-test/suite/plugins/t/pam_v1.test
index 754251167e9cd..d495965017338 100644
--- a/mysql-test/suite/plugins/t/pam_v1.test
+++ b/mysql-test/suite/plugins/t/pam_v1.test
@@ -1,4 +1,7 @@
 let $PAM_PLUGIN_VERSION= $AUTH_PAM_V1_SO;
+if (!$DIALOG_SO) {
+  skip No dialog client plugin;
+}
 --source pam_init.inc
 
 --write_file $MYSQLTEST_VARDIR/tmp/pam_good.txt
@@ -24,6 +27,11 @@ EOF
 --echo #
 --exec $MYSQL_TEST -u test_pam < $MYSQLTEST_VARDIR/tmp/pam_good.txt
 
+--echo #
+--echo # MDEV-40141 PAM authentication fails when started with --default-auth=dialog
+--echo #
+--exec echo 106 | $MYSQL --default-auth=dialog -u test_pam -psecret -e "select user(), current_user()" test
+
 --echo #
 --echo # athentication is unsuccessful
 --echo #
diff --git a/plugin/auth_pam/auth_pam.c b/plugin/auth_pam/auth_pam.c
index 86220f481835e..503c63bf77a05 100644
--- a/plugin/auth_pam/auth_pam.c
+++ b/plugin/auth_pam/auth_pam.c
@@ -158,7 +158,7 @@ static int pam_auth(MYSQL_PLUGIN_VIO *vio, MYSQL_SERVER_AUTH_INFO *info)
         if ((buf_len= read_string(c_to_p[0], (char *) buf, sizeof(buf))) < 0)
           goto error_ret;
 
-        if (!pkt || !*pkt || (buf[0] >> 1) != 2)
+        if (!pkt || pkt_len <= 0 || !*pkt || (buf[0] >> 1) != 2)
         {
           PAM_DEBUG((stderr, "PAM: sending CONV string.\n"));
           if (vio->write_packet(vio, buf, buf_len))
diff --git a/plugin/auth_pam/auth_pam_v1.c b/plugin/auth_pam/auth_pam_v1.c
index a38ef8f53ca36..26ef9ecb4c24a 100644
--- a/plugin/auth_pam/auth_pam_v1.c
+++ b/plugin/auth_pam/auth_pam_v1.c
@@ -25,7 +25,7 @@ struct param {
 static int roundtrip(struct param *param, const unsigned char *buf,
                      int buf_len, unsigned char **pkt)
 {
-  if (param->cached && *param->cached && (buf[0] >> 1) == 2)
+  if (param->cached && param->cached_len > 0 && *param->cached && (buf[0] >> 1) == 2)
   {
     *pkt= param->cached;
     param->cached= NULL;