crash due to narrowing cast in update_ref_and_keys()

7377

  sz= MY_MAX(sizeof(KEY_FIELD),sizeof(SARGABLE_PARAM))*

7378

    ((sel->cond_count*2 + sel->between_count)*m+1);

7379

  if (!(key_fields=(KEY_FIELD*) thd->alloc(sz)))

7380

    DBUG_RETURN(TRUE); /* purecov: inspected */

but sz is uint. When the size is larger than 2³², sz wraps around, key_fields is allocated too small which causes a crash later (esp. with ASAN). See the attached test case.

Reported by Ben Bidner (Automattic.com Security Team).