Rollup Group Concat temp Record Length Heap Overwrite

MariaDB 11.8.8 H44 source-level causal chain

1. sql/sql_select.cc JOIN::make_sum_func_list
When ROLLUP is initialized, invokes rollup_make_fields() before aggregate
setup.

2. sql/sql_select.cc JOIN::rollup_make_fields (about 30411-30485)
Copies every top-level Item_sum for each ROLLUP level and calls
Item_sum::make_unique().

3. sql/item_sum.cc Item_func_group_concat::make_unique (about 4453-4459)
Clears table/tree state and sets force_copy_fields=1.

4. sql/sql_select.cc setup_sum_funcs (about 29886-29894)
Calls aggregator_setup() for the original and copied aggregate objects.

5. sql/item_sum.cc Item_func_group_concat::setup (about 4312-4395)
Pushes every non-constant argument into all_fields, transfers
force_copy_fields to TMP_TABLE_PARAM, and calls create_tmp_table().

6. sql/sql_select.cc Create_tmp_table::add_field (about 21807-21829)
Adds each exact-copied Field_varstring::pack_length() to ulong
TABLE_SHARE::reclength. There is no total-width limit.

7. sql/sql_select.cc Create_tmp_table::finalize (about 22340-22425)
Adds the null bitmap to the wide reclength, then computes:

uint alloc_length = ALIGN_SIZE(share->reclength +
MI_UNIQUE_HASH_LENGTH + 1);
share->rec_buff_length = alloc_length;
alloc_root(..., alloc_length * 3);

Field relocation still advances using each full pack length, and
Field_varstring::reset() writes the full field width.

Boundary arithmetic for the archived trigger:

• source type: nullable VARBINARY(65520), pack length 65,522 bytes
• GROUP_CONCAT argument count: 65,550
• field bytes: 65,550 * 65,522 = 4,294,967,100
• null bitmap plus no-blob first-byte guard: 8,194 bytes
• logical record: 4,294,975,294 = 2^32 + 7,998
• aligned allocation length narrows to 8,008 bytes
• allocation request: 24,024 bytes plus MEM_ROOT bookkeeping/slack
• observed invalid operation: 65,522-byte Field_varstring::reset write

Two source rows are required to prevent const-table optimization from omitting
all GROUP_CONCAT temporary fields.

Crash:

SUMMARY: AddressSanitizer: use-after-poison (/home/mysql/mariadb/bld-asan/sql/mariadbd+0xdba3db) (BuildId: c7d61ccb1fa25c4f8a307796ca807e56ca3e66e7) in __asan_memset
Shadow bytes around the buggy address:
0x0eeed8ddefa0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0eeed8ddefb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0eeed8ddefc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0eeed8ddefd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0eeed8ddefe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0eeed8ddeff0: 00 00 00 00 00 00 00 00 00 00 00 00[f7]f7 f7 f7
0x0eeed8ddf000: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0eeed8ddf010: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0eeed8ddf020: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0eeed8ddf030: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0eeed8ddf040: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
Shadow byte legend (one shadow byte represents 8 application bytes)

Reproduce:
```bash
timeout --signal=TERM --kill-after=15s 300s \
bash novel/mariadb/rollup-group-concat-temp-record-length-heap-overwrite/reproduce-release.sh \
"$PWD/repro-output/rollup-control" control c1

timeout --signal=TERM --kill-after=15s 300s \
bash novel/mariadb/rollup-group-concat-temp-record-length-heap-overwrite/reproduce-release.sh \
"$PWD/repro-output/rollup-trigger" trigger t1
```