Bug#29921423 - MEMCPY-PARAM-OVERLAP IN CLI_READ_ROWS

DESCRIPTION
===========
There is a memcpy-param-overlap (likely leading to a multi
byte write heap buffer overflow) in function cli_read_rows
called by mysql_store_result.

FIX
===
Added appropriate boundary checks while reading the packets,
and if an invalid packet data is detected, an error is
returned.

RB: 24485

Author: Anushree Prakash B

sql-common/client.c

@@ -1,4 +1,4 @@
-/* Copyright (c) 2003, 2019, Oracle and/or its affiliates. All rights reserved.
+/* Copyright (c) 2003, 2020, Oracle and/or its affiliates. All rights reserved.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License, version 2.0,
@@ -1630,7 +1630,7 @@ MYSQL_DATA *cli_read_rows(MYSQL *mysql,MYSQL_FIELD *mysql_fields,
       else
       {
 	cur->data[field] = to;
-        if (len > (ulong) (end_to - to))
+        if (to > end_to || len > (ulong) (end_to - to))
         {
           free_rows(result);
           set_mysql_error(mysql, CR_MALFORMED_PACKET, unknown_sqlstate);