_ma_apply_redo_index: KEY_OP_SHIFT with negative length forms unchecked source/size (page buffer OOB move)

In `storage/maria/ma_key_recover.c`, `_ma_apply_redo_index()` handles `KEY_OP_SHIFT` as:

```c
case KEY_OP_SHIFT:
int length= sint2korr(header);
header+= 2;
DBUG_ASSERT(page_offset != 0 && page_offset <= page_length &&
page_length + length <= max_page_size);

if (length < 0)

{ DBUG_ASSERT(page_offset - length <= page_length); bmove(buff + page_offset, buff + page_offset - length, page_length - page_offset + length); }

else if (page_length != page_offset)
bmove_upp(buff + page_length + length, buff + page_length,
page_length - page_offset);
page_length+= length;
```

In release builds (`DBUG_OFF`), the asserts are no-ops. A negative redo `length` can make:

• source `buff + page_offset - length` point past the used page
• copy size `page_length - page_offset + length` wrap or become invalid
• later `page_length+= length` wrap

A corrupt `LOGREC_REDO_INDEX` applied during Aria recovery can therefore move data out of bounds.

1. 1. Impact

Crash recovery / redo apply can crash or corrupt memory on a malformed negative KEY_OP_SHIFT redo record.