updated comments for second part of the password cipher

packets.go

@@ -174,10 +174,18 @@ func (mc *mysqlConn) readInitPacket() ([]byte, error) {
 		// reserved (all [00]) [10 bytes]
 		pos += 1 + 2 + 2 + 1 + 10
 
-		// second part of the password cipher [12? bytes]
-		// The documentation is ambiguous about the length.
+		// second part of the password cipher [mininum 13 bytes],
+		// where len=MAX(13, length of auth-plugin-data - 8)
+		//
+		// The web documentation is ambiguous about the length. However,
+		// according to mysql-5.7/sql/auth/sql_authentication.cc line 538,
+		// the 13th byte is "\0 byte, terminating the second part of
+		// a scramble". So the second part of the password cipher is
+		// a NULL terminated string that's at least 13 bytes with the
+		// last byte being NULL.
+		//
 		// The official Python library uses the fixed length 12
-		// which is not documented but seems to work.
+		// which seems to work but technically could have a hidden bug.
 		cipher = append(cipher, data[pos:pos+12]...)
 
 		// TODO: Verify string termination