Low-privilege RCE in MariaDB: SYS_REFCURSOR cursor-array use-after-free chained with an ST_Area heap over-read

Low-privilege RCE in MariaDB: SYS_REFCURSOR cursor-array use-after-free chained with an ST_Area heap over-read

class sp_cursor_array: public Dynamic_array<sp_cursor_array_element>   // :220  elements stored inline
{
  sp_cursor_array()
   :Dynamic_array(PSI_INSTRUMENT_MEM, 0)   // :237  prealloc=0
  {}