Stored Program Virtual Record Length Heap Overwrite

MariaDB source revision: 46a8eb42a520193686d9a16d4cea4b3e002917e4
Public main checked: f4299f0bbf38820794295bd4cae427544681cbd1
Public 11.8 checked: d26f9ab217a7fcf9d4eccc62c01020ff275ff42e

sql/table.h:
ulong reclength;
uint rec_buff_length;

sql/sql_select.cc, Virtual_tmp_table::open():
uint null_pack_length= (s->null_fields + 7) / 8;
s->reclength+= null_pack_length;
s->rec_buff_length= ALIGN_SIZE(s->reclength + 1);
if (!(record[0]= in_use->alloc<uchar>(s->rec_buff_length)))
return true;
setup_field_pointers();

sql/sql_select.cc, Virtual_tmp_table::setup_field_pointers():
uchar *field_pos= record[0] + s->null_bytes;
...
cur_field->move_field(field_pos, ...);
cur_field->reset();
field_pos+= cur_field->pack_length();

sql/sp_rcontext.cc:
m_var_table= create_virtual_tmp_table(thd, field_def_lst);

Trigger arithmetic:
65538 * (65532 + 2) = 4,294,967,292 bytes of fields
ceil(65538 / 8) = 8,193 bytes of NULL flags
reclength = 4,294,975,485 = 2^32 + 8,189
ALIGN_SIZE(+1) = 2^32 + 8,192
uint rec_buff_length= 8,192
first field starts at record + 8,193 and reset writes 65,534 bytes

Crash:
Thread pointer: 0x771080000c68
stack_bottom = 0x7f10b4cce000 thread_stack 0x49000
Printing to addr2line failed
mariadbd(my_print_stacktrace+0x30)[0x55948a82ab10]
mariadbd(handle_fatal_signal+0x1d7)[0x55948a3fb237]
/lib/x86_64-linux-gnu/libc.so.6(+0x45330)[0x7f10cbb5f330]
/lib/x86_64-linux-gnu/libc.so.6(+0x1896ca)[0x7f10cbca36ca]
mariadbd(+0x73937f)[0x55948a09837f]
mariadbd(_ZN17Virtual_tmp_table20setup_field_pointersEv+0x58)[0x55948a1b2198]
mariadbd(_ZN17Virtual_tmp_table4openEv+0x92)[0x55948a1b2b42]
mariadbd(+0x733636)[0x55948a092636]
mariadbd(_ZN11sp_rcontext6createEP3THDP7sp_headPK11sp_pcontextP5FieldR19Row_definition_list+0xc6)[0x55948a093596]
mariadbd(_ZN7sp_head15rcontext_createEP3THDP5FieldP4ListI4ItemE+0x7d)[0x55948a09371d]
mariadbd(_ZN7sp_head17execute_procedureEP3THDP4ListI4ItemE+0x688)[0x55948a095e68]
mariadbd(+0x7da9a9)[0x55948a1399a9]
mariadbd(_ZN12Sql_cmd_call7executeEP3THD+0x19b)[0x55948a13a33b]
mariadbd(_Z21mysql_execute_commandP3THDb+0xfe0)[0x55948a14db40]
mariadbd(_Z11mysql_parseP3THDPcjP12Parser_state+0x1cd)[0x55948a15284d]
mariadbd(_Z16dispatch_command19enum_server_commandP3THDPcjb+0x1a03)[0x55948a140d03]
mariadbd(_Z10do_commandP3THDb+0x1e8)[0x55948a142a28]
mariadbd(_Z24do_handle_one_connectionP7CONNECTb+0x1e3)[0x55948a2b71c3]
mariadbd(handle_one_connection+0x71)[0x55948a2b7931]
mariadbd(+0xc7dc4c)[0x55948a5dcc4c]
/lib/x86_64-linux-gnu/libc.so.6(+0x9cb84)[0x7f10cbbb6b84]
/lib/x86_64-linux-gnu/libc.so.6(__clone+0x44)[0x7f10cbc43b64]

Connection ID (thread ID): 13
Status: NOT_KILLED
Query (0x771080035540): CALL h39.p()

Reproduce:
use reproduce.sql