OOB read for used_checksum_alg on malformed Format_description_log_event

This is similar to MDEV-40365, but for the Checksum Algorithm field, used_checksum_alg.

get_checksum_alg()

• CWE-125: Out-of-bounds Read

This Format Description does not check whether the passed buffer has sufficient length at all.
It is as if expecting the caller to have already verified it, but its callers validate event contents after calling get_checksum_alg() (the common header is checked before this point).

If the passed buffer has less length than expected, both the server version check and the actual algorithm ID retrieval may read from wrong locations, possibly outside the passed buffer.
While the outcome is harmless since this is a read-only function that outputs “a” checksum approach, it is the read from outside the buffer that can trigger a memory failure.

Format Description parser constructor

• CWE-131 Incorrect Calculation of Buffer Size → CWE-191 Integer Underflow → CWE-125: Out-of-bounds Read → ...

If the Format Description's server version supports checksumming, then the algorithm is fetched and removed from the last byte of the post_header_len array.
⸺ MDEV-40365

But the code does not check whether the array has a last byte in the first place.

If there are 0 elements in the array, the array pop operation will underflow number_of_event_types from 0 to 255, marking post_header_len an array of 255 elements, none of which is in the 0-byte memory allocated to it.
The serious consequences of a corrupted post_header_len array are described in MDEV-40365.

The used_checksum_alg field is then also corrupted from reading from "index 255 (256th element)" of the array.

Reproduction

get_checksum_alg()

Craft a Format Description Event with a length of 19+checksum:

1. 19-byte common header (LOG_EVENT_MINIMAL_HEADER_LEN)
2. no room for anything else

TODO: confirm effect

Format Description parser constructor

Craft a Format Description Event with a length of 76+checksum:

1. 19-byte common header (LOG_EVENT_MINIMAL_HEADER_LEN)
2. 56-byte post-header (ST_COMMON_HEADER_LEN_OFFSET)
3. 1-byte common_header_len
4. 0-byte post_header_len array
5. no room for used_checksum_alg

The DBUG_ASSERT() in get_checksum_alg() will most likely fail; if it does not (including after fix), ASan will trip in the Format Description parser constructor when reading the used_checksum_alg.

Format Description server versions that read the used_checksum_alg field

• MySQL 5.6.1 and above
• MariaDB 5.3.0 and above