_ma_apply_redo_index: KEY_OP_MULTI_COPY memcpy uses unchecked to/from/full_length (page buffer OOB write)

In storage/maria/ma_key_recover.c, _ma_apply_redo_index() handles KEY_OP_MULTI_COPY roughly as:

case KEY_OP_MULTI_COPY:

  full_length= uint2korr(header);

  header+= 2;

  log_memcpy_length= uint2korr(header);

  header+= 2;

  log_memcpy_end= header + log_memcpy_length;

  while (header < log_memcpy_end)

  {

    to= uint2korr(header); header+= 2;

    from= uint2korr(header); header+= 2;

    DBUG_ASSERT(MY_MAX(from, to) < max_page_size);

    memcpy(buff + to, buff + from, full_length);

  }

In release builds (DBUG_OFF), the asserts are no-ops. There is no runtime check that:

• to + full_length / from + full_length stay inside the page buffer
• log_memcpy_end stays inside the redo record (header_end)

A corrupt LOGREC_REDO_INDEX applied during Aria recovery can therefore write past the page buffer.

Impact

Crash recovery / redo apply can crash or corrupt memory when processing a malformed MULTI_COPY redo record.