ASAN global-buffer-overflow in find_type_eol with embedded NUL in optimizer_switch

I found an ASAN global-buffer-overflow when setting optimizer_switch to a value containing an embedded NUL byte.

Version:
13.0.1-MariaDB-asan-debug

Source tag:
mariadb-13.0.1

Reproducer:
The SQL input contains a real NUL byte after "on" in the string literal.

Text representation:
SET optimizer_switch = 'mrr=on\0';

Hex around the value:
6d 72 72 3d 6f 6e 00
m r r = o n NUL

Expected result:
The server should reject the malformed value or handle it without reading past the end of global string constants.

Observed result:
ASAN reports a global-buffer-overflow in find_type_eol and the server aborts.

ASAN summary:
AddressSanitizer: global-buffer-overflow /home/mariadb/mysys/typelib.c:94:11 in find_type_eol

Top stack:
#0 find_type_eol /home/mariadb/mysys/typelib.c:94
#1 parse_name /home/mariadb/mysys/typelib.c:290
#2 find_set_from_flags /home/mariadb/mysys/typelib.c:364
#3 Sys_var_flagset::do_check(THD*, set_var*) /home/mariadb/sql/sys_vars.inl:1452
#4 sys_var::check(THD*, set_var*) /home/mariadb/sql/set_var.cc:256
#5 set_var::check(THD*) /home/mariadb/sql/set_var.cc:824
#6 sql_set_variables(THD*, List<set_var_base>*, bool) /home/mariadb/sql/set_var.cc:750

ASAN details:
READ of size 1
0 bytes to the right of global variable '.str.20'
'.str.20' is ascii string 'on'

Notes:
This reproduces with ASAN/debug build. I have not confirmed impact on non-ASAN release builds.
The same issue also reproduces with:
SET optimizer_switch = 'mrr=off\0';
SET optimizer_switch = 'mrr=default\0';