Fixed handling of responses larger than 100K.

We have a limitation of how much we process per mysql response
(MAX_PAYLOAD_SIZE) but there was a bug in which we were referring to
the trimmed size instead of the real size when eating data from the buffer.

protos/mysql/mysql.go

@@ -179,7 +179,7 @@ func (mysql *Mysql) Init(test_mode bool, results chan common.MapStr) error {
 }
 
 func (stream *MysqlStream) PrepareForNewMessage() {
-	stream.data = stream.data[stream.message.end:]
+	stream.data = stream.data[stream.parseOffset:]
 	stream.parseState = mysqlStateStart
 	stream.parseOffset = 0
 	stream.isClient = false
@@ -458,6 +458,7 @@ func (mysql *Mysql) Parse(pkt *protos.Packet, tcptuple *common.TcpTuple,
 		}
 
 		ok, complete := mysqlMessageParser(priv.Data[dir])
+		//logp.Debug("mysqldetailed", "mysqlMessageParser returned ok=%b complete=%b", ok, complete)
 		if !ok {
 			// drop this tcp stream. Will retry parsing with the next
 			// segment in it

tests/test_0017_mysql_long_result.py

@@ -96,3 +96,19 @@ def test_larger_max_rows(self):
 
         lines = res["response"].strip().split("\n")
         assert len(lines) == 16    # 15 plus header
+
+    def test_larger_than_100k(self):
+        """
+        Should work for MySQL messages larger than 100k bytes.
+        """
+        self.render_config_template(
+            mysql_ports=[3306],
+            mysql_send_response=True
+        )
+        self.run_packetbeat(pcap="mysql_long.pcap",
+                            debug_selectors=["mysqldetailed"])
+
+        objs = self.read_output()
+        assert len(objs) == 1
+        res = objs[0]
+        assert res["mysql.num_rows"] == 400