Add missing check in mysqlnd_auth.c

[kamil-tekiela]

Identified by Claude. Not sure if it causes any issues currently, but judging by how other plugins operate, there should be a check here too. Claude believes there's a remote chance this could even be exploited, although I doubt it's a security issue.

[Sjord]

Looks good to me.

It seems that it already read SCRAMBLE_LENGTH bytes from the auth_plugin_data:

mysqlnd_xor_string(xor_str, passwd_len, (char *) auth_plugin_data, SCRAMBLE_LENGTH);

So the risk is that the client sends uninitialized memory to the server if the scramble is too short.

@nikic Could you take a look at this?

[kamil-tekiela]

@bukka Should this PR be closed too? Are you still working on it?

[bukka]

I will check it so keep it open please. Not part of that other thing though.