OOB read and integer underflow in init_read_hdr() via untrusted dynamic column header

In libmariadb/mariadb_dyncol.c, init_read_hdr() derives pointer offsets (hdr->nmpool, hdr->dtpool) and computes hdr->data_size without validating that fixed_hdr + header_size + nmpool_size <= str->length.

A malformed dynamic column blob with inconsistent header fields causes:

• nmpool and dtpool pointers to extend past str->str + str->length, leading to out-of-bounds reads in downstream functions like mariadb_dyncol_get_named().
• hdr->data_size to underflow, wrapping around to a large size and bypassing downstream length checks.

This check already exists in mariadb_dyncol_check() (line 3689) but is missing from init_read_hdr(), affecting all public API entry points.

  if (fmt->fixed_hdr + header.header_size + header.nmpool_size > str->length)

  {

    goto end;

  }

originally reported by AISLE research