MDEV-6044 MySQL BUG#12735829 - SPACE() FUNCTION WARNING REFERS TO REPEAT() IN ER_WARN_ALLOWED_PACKET_OVERFLOWED

Merged from 5.6

6 files changed, 128 insertions, 28 deletions

diff --git a/mysql-test/r/ctype_utf16.result b/mysql-test/r/ctype_utf16.result
index b772c0e4370..074fc28a6b7 100644
--- a/mysql-test/r/ctype_utf16.result
+++ b/mysql-test/r/ctype_utf16.result
@@ -1549,7 +1549,7 @@ SELECT space(date_add(101, INTERVAL CHAR('1' USING utf16) hour_second));
 space(date_add(101, INTERVAL CHAR('1' USING utf16) hour_second))
 NULL
 Warnings:
-Warning	1301	Result of repeat() was larger than max_allowed_packet (1048576) - truncated
+Warning	1301	Result of space() was larger than max_allowed_packet (1048576) - truncated
 #
 # Bug#11750518 41090: ORDER BY TRUNCATES GROUP_CONCAT RESULT
 #
diff --git a/mysql-test/r/func_str.result b/mysql-test/r/func_str.result
index 44a67fe6b27..bc5f6951184 100644
--- a/mysql-test/r/func_str.result
+++ b/mysql-test/r/func_str.result
@@ -845,7 +845,7 @@ explain extended select concat('*',space(5),'*');
 id	select_type	table	type	possible_keys	key	key_len	ref	rows	filtered	Extra
 1	SIMPLE	NULL	NULL	NULL	NULL	NULL	NULL	NULL	NULL	No tables used
 Warnings:
-Note	1003	select concat('*',repeat(' ',5),'*') AS `concat('*',space(5),'*')`
+Note	1003	select concat('*',space(5),'*') AS `concat('*',space(5),'*')`
 explain extended select reverse('abc');
 id	select_type	table	type	possible_keys	key	key_len	ref	rows	filtered	Extra
 1	SIMPLE	NULL	NULL	NULL	NULL	NULL	NULL	NULL	NULL	No tables used
@@ -2083,7 +2083,7 @@ select space(4294967295);
 space(4294967295)
 NULL
 Warnings:
-Warning	1301	Result of repeat() was larger than max_allowed_packet (1048576) - truncated
+Warning	1301	Result of space() was larger than max_allowed_packet (1048576) - truncated
 select space(-4294967296);
 space(-4294967296)
 
@@ -2091,7 +2091,7 @@ select space(4294967296);
 space(4294967296)
 NULL
 Warnings:
-Warning	1301	Result of repeat() was larger than max_allowed_packet (1048576) - truncated
+Warning	1301	Result of space() was larger than max_allowed_packet (1048576) - truncated
 select space(-4294967297);
 space(-4294967297)
 
@@ -2099,7 +2099,7 @@ select space(4294967297);
 space(4294967297)
 NULL
 Warnings:
-Warning	1301	Result of repeat() was larger than max_allowed_packet (1048576) - truncated
+Warning	1301	Result of space() was larger than max_allowed_packet (1048576) - truncated
 select space(-18446744073709551615);
 space(-18446744073709551615)
 
@@ -2110,7 +2110,7 @@ select space(18446744073709551615);
 space(18446744073709551615)
 NULL
 Warnings:
-Warning	1301	Result of repeat() was larger than max_allowed_packet (1048576) - truncated
+Warning	1301	Result of space() was larger than max_allowed_packet (1048576) - truncated
 select space(-18446744073709551616);
 space(-18446744073709551616)
 
@@ -2123,7 +2123,7 @@ NULL
 Warnings:
 Warning	1916	Got overflow when converting '18446744073709551616' to INT. Value truncated.
 Warning	1916	Got overflow when converting '18446744073709551616' to INT. Value truncated.
-Warning	1301	Result of repeat() was larger than max_allowed_packet (1048576) - truncated
+Warning	1301	Result of space() was larger than max_allowed_packet (1048576) - truncated
 select space(-18446744073709551617);
 space(-18446744073709551617)
 
@@ -2136,7 +2136,7 @@ NULL
 Warnings:
 Warning	1916	Got overflow when converting '18446744073709551617' to INT. Value truncated.
 Warning	1916	Got overflow when converting '18446744073709551617' to INT. Value truncated.
-Warning	1301	Result of repeat() was larger than max_allowed_packet (1048576) - truncated
+Warning	1301	Result of space() was larger than max_allowed_packet (1048576) - truncated
 select rpad('hello', -1, '1');
 rpad('hello', -1, '1')
 NULL
@@ -4513,3 +4513,20 @@ SELECT FROM_BASE64(TO_BASE64(dt1)) FROM t1;
 FROM_BASE64(TO_BASE64(dt1))
 2011-01-01 02:03:04
 DROP TABLE t1;
+SELECT SPACE(@@global.max_allowed_packet*2);
+SPACE(@@global.max_allowed_packet*2)
+NULL
+Warnings:
+Warning	1301	Result of space() was larger than max_allowed_packet (1048576) - truncated
+SET NAMES latin1;
+PREPARE stmt FROM "SELECT COLLATION(space(2))";
+EXECUTE stmt;
+COLLATION(space(2))
+latin1_swedish_ci
+SET NAMES latin2;
+EXECUTE stmt;
+COLLATION(space(2))
+latin2_general_ci
+#
+# End of 5.6 tests
+#
diff --git a/mysql-test/t/func_str.test b/mysql-test/t/func_str.test
index f04fda55608..6369609bea3 100644
--- a/mysql-test/t/func_str.test
+++ b/mysql-test/t/func_str.test
@@ -1719,3 +1719,26 @@ SELECT FROM_BASE64(TO_BASE64(t1)) FROM t1;
 SELECT FROM_BASE64(TO_BASE64(d1)) FROM t1;
 SELECT FROM_BASE64(TO_BASE64(dt1)) FROM t1;
 DROP TABLE t1;
+
+
+#
+# BUG #12735829: SPACE() FUNCTION WARNING REFERS TO REPEAT() IN ER_WARN_ALLOWED_PACKET_OVERFLOWED 
+#
+
+SELECT SPACE(@@global.max_allowed_packet*2);
+
+
+#
+# BUG #11746123-23637: CHARSET AND COLLATION OF THE FUNCTION SPACE()  
+#
+
+SET NAMES latin1;
+PREPARE stmt FROM "SELECT COLLATION(space(2))";
+EXECUTE stmt;
+SET NAMES latin2;
+EXECUTE stmt;
+
+
+--echo #
+--echo # End of 5.6 tests
+--echo #
diff --git a/sql/item_create.cc b/sql/item_create.cc
index 35716937f12..fa8249c3321 100644
--- a/sql/item_create.cc
+++ b/sql/item_create.cc
@@ -5235,26 +5235,7 @@ Create_func_space Create_func_space::s_singleton;
 Item*
 Create_func_space::create_1_arg(THD *thd, Item *arg1)
 {
-  /**
-    TODO: Fix Bug#23637
-    The parsed item tree should not depend on
-    <code>thd->variables.collation_connection</code>.
-  */
-  CHARSET_INFO *cs= thd->variables.collation_connection;
-  Item_string *sp;
-
-  if (cs->mbminlen > 1)
-  {
-    uint dummy_errors;
-    sp= new (thd->mem_root) Item_string("", 0, cs, DERIVATION_COERCIBLE, MY_REPERTOIRE_ASCII);
-    sp->copy_value(" ", 1, &my_charset_latin1, cs, &dummy_errors);
-  }
-  else
-  {
-    sp= new (thd->mem_root) Item_string(" ", 1, cs, DERIVATION_COERCIBLE, MY_REPERTOIRE_ASCII);
-  }
-
-  return new (thd->mem_root) Item_func_repeat(sp, arg1);
+  return new (thd->mem_root) Item_func_space(arg1);
 }
 
 
diff --git a/sql/item_strfunc.cc b/sql/item_strfunc.cc
index c3e765e21b5..01ff2d412f2 100644
--- a/sql/item_strfunc.cc
+++ b/sql/item_strfunc.cc
@@ -2999,6 +2999,75 @@ err:
 }
 
 
+void Item_func_space::fix_length_and_dec()
+{
+  collation.set(default_charset(), DERIVATION_COERCIBLE, MY_REPERTOIRE_ASCII); 
+  if (args[0]->const_item())
+  {
+    /* must be longlong to avoid truncation */
+    longlong count= args[0]->val_int();
+    if (args[0]->null_value)
+      goto end;
+    /*
+     Assumes that the maximum length of a String is < INT_MAX32. 
+     Set here so that rest of code sees out-of-bound value as such. 
+    */
+    if (count > INT_MAX32)
+      count= INT_MAX32;
+    fix_char_length_ulonglong(count); 
+    return;
+  }
+
+end:
+  max_length= MAX_BLOB_WIDTH;
+  maybe_null= 1;
+}
+
+
+String *Item_func_space::val_str(String *str)
+{
+  uint tot_length;
+  longlong count= args[0]->val_int();
+  const CHARSET_INFO *cs= collation.collation;
+   
+  if (args[0]->null_value)
+    goto err;				// string and/or delim are null
+  null_value= 0;
+
+  if (count <= 0 && (count == 0 || !args[0]->unsigned_flag))
+    return make_empty_result();
+  /*
+   Assumes that the maximum length of a String is < INT_MAX32. 
+   Bounds check on count:  If this is triggered, we will error. 
+  */
+  if ((ulonglong) count > INT_MAX32)
+    count= INT_MAX32;
+
+  // Safe length check
+  tot_length= (uint) count * cs->mbminlen;
+  if (tot_length > current_thd->variables.max_allowed_packet)
+  {
+    push_warning_printf(current_thd, Sql_condition::WARN_LEVEL_WARN,
+                        ER_WARN_ALLOWED_PACKET_OVERFLOWED,
+                        ER(ER_WARN_ALLOWED_PACKET_OVERFLOWED),
+                        func_name(),
+                        current_thd->variables.max_allowed_packet);
+    goto err;
+   }
+
+  if (str->alloc(tot_length))
+    goto err;
+  str->length(tot_length);
+  str->set_charset(cs);
+  cs->cset->fill(cs, (char*) str->ptr(), tot_length, ' ');
+  return str; 
+
+err:
+  null_value= 1;
+  return 0;
+}
+
+
 void Item_func_binlog_gtid_pos::fix_length_and_dec()
 {
   collation.set(system_charset_info);
diff --git a/sql/item_strfunc.h b/sql/item_strfunc.h
index 01a88e229d5..8377a20e0a4 100644
--- a/sql/item_strfunc.h
+++ b/sql/item_strfunc.h
@@ -719,6 +719,16 @@ public:
 };
 
 
+class Item_func_space :public Item_str_func
+{
+public:
+  Item_func_space(Item *arg1):Item_str_func(arg1) {}
+  String *val_str(String *);
+  void fix_length_and_dec();
+  const char *func_name() const { return "space"; }
+};
+
+
 class Item_func_binlog_gtid_pos :public Item_str_func
 {
   String tmp_value;