Compress Result Metadata Uint32 Wrap

MariaDB 11.8.8
Source revision: 46a8eb42a520193686d9a16d4cea4b3e002917e4

sql/item_strfunc.h:2357-2366

  class Item_func_compress: public Item_str_binary_checksum_func

  {

    ...

    bool fix_length_and_dec(THD *thd) override

    {

      max_length= (args[0]->max_length * 120) / 100 + 12;

      return FALSE;

    }

sql/item_strfunc.cc:4791-4849

val_str() evaluates the actual argument, computes a runtime buffer from its
actual length, prepends the four-byte original length, compresses into the
buffer, and sets the String length from the actual compressed byte count.
It does not use the wrapped metadata to truncate its direct result.

Root cause: the producer metadata multiplication uses uint32 arithmetic before
division and has no wide/saturating guard. Temporary/materialized consumers
trust that too-small declaration.

Current 11.8 revision d26f9ab217a7fcf9d4eccc62c01020ff275ff42e
(11.8.9 development state) retains the exact expression at
sql/item_strfunc.h:2365.

Reproduce:
timeout --signal=TERM --kill-after=15s 180s \
bash novel/mariadb/compress-result-metadata-uint32-wrap/run_official.sh \
"$PWD/repro-output/mariadb-compress-metadata" live1

cat repro-output/mariadb-compress-metadata/status.tsv
cat repro-output/mariadb-compress-metadata/query.stdout
cat repro-output/mariadb-compress-metadata/query.stderr