This bug occurs when mariadb_rpl_fetch() reads a Rows event that contains extra_data. This occurs, for example, in MySQL 8, if the table is partitioned by range.

This code is wrong and leads to a crash:

if (rpl_event->event.rows.extra_data_size - 2 > 0) {

rpl_set_string_and_len(rpl_event->event.rows.extra_data, ev, rpl_event-
>event.rows.extra_data_size - 2);

ev+= rpl_event->event.rows.extra_data_size;

}

The correct code should be something like this:

if (rpl_event->event.rows.extra_data_size - 2 > 0) {

rpl_alloc_set_string_and_len(...);

ev += (rpl_event->event.rows.extra_data_size - 2);

}