Out-of-bound reads in loose index scan

[Alexey Kopytov]

Found using AddressSanitizer testing.

When the code QUICK_GROUP_MIN_MAX_SELECT::add_range() constructs a new QUICK_RANGE object, there's an implicit assumption that sel_range->min_value and sel_range->max_value contain at least min_max_arg_len + 1 bytes, because the QUICK_RANGE constructor calls sql_memdup({min,max}_key_arg,min_length_arg+1).

However, that's not the case for cases when either of the arguments is a pointer to 'is_null_string' which is a 2-byte static buffer. This is the case detected by AddressSanitizer during a main.group_min_max test run.

How to repeat:
Examine the code or run main.group_min_max against an AddressSanitizer-instrumented server binary.