Fix heap buffer over-read in mthd_my_read_rows during row/metadata parsing

A security vulnerability was identified in mthd_my_read_rows() where field payload lengths (len) parsed from incoming packets were only validated against the destination buffer (end_to), but not against the remaining source network packet buffer (end_cp).

Because end_to includes additional stack allocation bytes intended for field NUL-terminators (to + fields + pkt_len - 1), end_to - to can evaluate to a value larger than the actual bytes remaining in net->buff. An attacker sending a crafted packet with an inflated field length prefix could bypass destination bounds checks, causing memcpy() to read out-of-bounds bytes past end_cp (Heap Buffer Over-Read).

Additionally, when processing metadata rows where fields is configured dynamically (e.g., fields = 9 due to ma_has_extended_type_info), standard 8-field server packets can consume all payload bytes prior to the last field iteration. In this state (cp == end_cp), attempting to invoke net_field_length(&cp) results in an out-of-bounds byte dereference on *cp.

Thanks to fg0x0 for reporting this issue