**Describe the bug**
https://clickhouse-test-reports.s3.yandex.net/19702/c74631c650b42e4d107254a03bd82c2c2913039b/fuzzer_msan/server.log

Most likely introduced here: #11006
{
    if (limit == 0)
        return ColumnFixedString::create(n);
    auto res = ColumnFixedString::create(n);
    Chars & res_chars = res->chars;
    res_chars.resize(n * limit);
    size_t offset = 0;
    for (size_t i = 0; i < limit; ++i, offset += n)
        memcpySmallAllowReadWriteOverflow15(&res_chars[offset], &chars[indexes[i] * n], n);
    return res;
}
ColumnPtr ColumnFixedString::replicate(const Offsets & offsets) const
{
    size_t col_size = size();
    if (col_size != offsets.size())
        throw Exception("Size of offsets doesn't match size of column.", ErrorCodes::SIZES_OF_COLUMNS_DOESNT_MATCH);
    auto res = ColumnFixedString::create(n);
    if (0 == col_size)
        return res;
    Chars & res_chars = res->chars;
    res_chars.resize(n * offsets.back());
    Offset curr_offset = 0;
    for (size_t i = 0; i < col_size; ++i)
        for (size_t next_offset = offsets[i]; curr_offset < next_offset; ++curr_offset)
            memcpySmallAllowReadWriteOverflow15(&res->chars[curr_offset * n], &chars[i * n], n);
    return res;
}
void ColumnFixedString::gather(ColumnGathererStream & gatherer)