Out-of-bounds read in MariaDB .frm parsing enables RCE via vtable hijacking

MariaDB does not validate the upper bound of the attacker-controlled `key_part->fieldnr` value parsed from a crafted `.frm` file before using it as an index into the `share->field[]` array. The code only verifies that `fieldnr` is not zero. It does not verify that `fieldnr` is less than or equal to …

// mariadb-10.4.18/sql/table.cc:2705
// mariadb-11.8.8/sql/table.cc:3162
// mariadb-12.3.2/sql/table.cc:3201
// mariadb-13.1.0/sql/table.cc:3209
if (!key_part->fieldnr)
   goto err;

field = key_part->field = share->field[key_part->fieldnr - 1];

// mariadb-11.8.8/sql/table.cc:3166
// …