**Describe the bug**
https://clickhouse-test-reports.s3.yandex.net/19702/c74631c650b42e4d107254a03bd82c2c2913039b/fuzzer_msan/server.log

Most likely introduced here: #11006
const PaddedPODArray<T> & src_elems, const IColumn::Offsets & src_offsets,
        PaddedPODArray<T> & res_elems, IColumn::Offsets * res_offsets,
        const IColumn::Filter & filt, ssize_t result_size_hint)
    {
        const size_t size = src_offsets.size();
        if (size != filt.size())
            throw Exception("Size of filter doesn't match size of column.", ErrorCodes::SIZES_OF_COLUMNS_DOESNT_MATCH);
        ResultOffsetsBuilder result_offsets_builder(res_offsets);
        if (result_size_hint)
        {
            result_offsets_builder.reserve(result_size_hint, size);
            if (result_size_hint < 0)
                res_elems.reserve(src_elems.size());
            else if (result_size_hint < 1000000000 && src_elems.size() < 1000000000)    
                res_elems.reserve((result_size_hint * src_elems.size() + size - 1) / size);
        }
        const UInt8 * filt_pos = filt.data();
        const auto * filt_end = filt_pos + size;
        const auto * offsets_pos = src_offsets.data();
        const auto * offsets_begin = offsets_pos;
        
        const auto copy_array = [&] (const IColumn::Offset * offset_ptr)
        {
            const auto arr_offset = offset_ptr == offsets_begin ? 0 : offset_ptr[-1];