From fd85cc827c3adb2376a58db6f0e469148bce880a Mon Sep 17 00:00:00 2001
From: Kevin Malachowski <chowski@google.com>
Date: Thu, 29 Oct 2015 16:28:34 -0700
Subject: [PATCH] Actually zero out the bytes in the HandshakeResponse320 : The
 specification says these bytes should be zero but the current implementation
 simply ignores them. Since takeSmallBuffer ends up reusing a buffer for this
 packet the values might not be all zeros.

---
 packets.go | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/packets.go b/packets.go
index 14395bf9a..76cb7c84e 100644
--- a/packets.go
+++ b/packets.go
@@ -282,7 +282,10 @@ func (mc *mysqlConn) writeAuthPacket(cipher []byte) error {
 	}
 
 	// Filler [23 bytes] (all 0x00)
-	pos := 13 + 23
+	pos := 13
+	for ; pos < 13+23; pos++ {
+		data[pos] = 0
+	}
 
 	// User [null terminated string]
 	if len(mc.cfg.user) > 0 {