GHSA-4jq2-8v3c-97w8 MariaDB Connector/J: XA recover() trusted server-supplied gtrid and bqual lengths

• Maven org.mariadb.jdbc:mariadb-java-client: >= 3.0.0, < 3.3.7 → fixed in 3.3.7 • Maven org.mariadb.jdbc:mariadb-java-client: >= 3.4.0, < 3.4.5 → fixed in 3.4.5 • Maven org.mariadb.jdbc:mariadb-java-client: >= 3.5.0, < 3.5.11 → fixed in 3.5.11

Summary `XAResource.recover()` in MariaDB Connector/J trusted the `gtrid_length` and `bqual_length` columns returned by `XA RECOVER` to allocate and split each Xid. Details `MariaDbPoolConnection` and `MariaDbPoolPinnedConnection` built each `Xid` of the recovery list by allocating `new byte[gtrid_length]` and `new byte[bqual_length]` and copying from the `data` column, without validating the lengths against the XA specification bounds (`Xid.MAXGTRIDSIZE`, `Xid.MAXBQUALSIZE`) or the actual payload. Negative or oversized lengths, or lengths that do not fit the data, ended in large allocations or unchecked exceptions (`NegativeArraySizeException`, `ArrayIndexOutOfBoundsException`) during recovery. The fix validates the lengths before any allocation or copy and reports an invalid row as an `XAException` (`XAER_RMFAIL`). Impact Availability only, and limited to applications running XA recovery: a malicious or compromised server, or a MitM, can crash the recovery or drive large allocations. Exploitation requires control of the server side of the connection. Credit Reported by fg0x0