libmariadb ( mariadb-connector-c ): stack overflow via server-controlled field->length in prepared-statement codec

MariaDB Connector/C (libmariadb) calls `alloca()` with a length value read directly from the server's column-definition packet without any upper bound. A malicious MariaDB/MySQL server, or a MITM attacker on a non-TLS connection, can set `field->length` to a value exceeding the process stack size, …

static void convert_from_long(MYSQL_BIND *r_param, const MYSQL_FIELD *field,
                               long long val)
{
  // ...
  default:
    {
      char *buffer;
      buffer = alloca(MAX(field->length, 22));  // <-- no upper bound
      // ...
    }
}