Stack Buffer Overflow via Crafted keyseg->start/ keyseg->length in .MYI File (MariaDB MyISAM)

A stack buffer overflow exists in MariaDB's MyISAM storage engine. `mi_update()` declares a fixed-size stack buffer `old_key[HA_MAX_KEY_BUFF]` (1208 bytes) and passes it to `_mi_make_key()`, which copies `keyseg->length` bytes from `record + keyseg->start` into this buffer. Both fields are read …

uchar *mi_keyseg_read(uchar *ptr, HA_KEYSEG *keyseg)
{
   keyseg->length = mi_uint2korr(ptr);  ptr +=2;  // uint16 from .MYI, no bounds check
   // ...
}