Event contents are written using these conventions:
Numbers are written in little-endian format (least significant byte first), unless otherwise indicated.
Values that represent positions or lengths are given in bytes and should be considered unsigned.
Some numbers are written as Packed Integers. The format is described later in this section.
Strings are written in varying formats:
A string may be written to a fixed-length field and null-padded (with 0x00 bytes) on the right.
A variable-length string may be preceded by a length field that indicates the length of the string.
Some variable-length strings are null-terminated; others are not. The descriptions for individual string fields indicates which is the case.
For null-terminated strings that are preceded by a length field, the length does not include the terminating null byte, unless otherwise indicated.
If there is a variable-length string at the end of an event and no length field precedes it, its length may be determined as the event length minus the length of the other fields in the event.
Some events use Packed Integers, a special format for efficient representation of unsigned integers. A Packed Integer has the capacity of storing up to 8-byte integers, while small integers still can use 1, 3, or 4 bytes. The value of the first byte determines how to read the number, according to the following table.
The first byte is the number (in the range 0-250). No additional bytes are used.
Two more bytes are used. The number is in the range 251-0xffff.
Three more bytes are used. The number is in the range 0xffff-0xffffff.
Eight more bytes are used. The number is in the range 0xffffff-0xffffffffffffffff.
Packed Integer format derives from the "Length Coded Binary" representation used in the MySQL client/server network protocol (see Chapter 15, MySQL Client/Server Protocol). That representation allows a first byte value of 251 to represent the SQL NULL value, but 251 is apparently unused for Packed Integers in the binary log.