MDEV-759 lp:998340 - Valgrind complains on simple selects containing expression DAY(FROM_UNIXTIME(-1))

check item->null_value before using the result of item->val_int()

3 files changed, 43 insertions, 6 deletions

diff --git a/mysql-test/r/func_str.result b/mysql-test/r/func_str.result
index 8f4038e1239..aef452b7b50 100644
--- a/mysql-test/r/func_str.result
+++ b/mysql-test/r/func_str.result
@@ -2628,4 +2628,22 @@ SELECT * FROM t1;
 a
 aaaaaaaaaaaaaa
 DROP TABLE t1;
+SELECT SUBSTRING('1', DAY(FROM_UNIXTIME(-1)));
+SUBSTRING('1', DAY(FROM_UNIXTIME(-1)))
+NULL
+SELECT LEFT('1', DAY(FROM_UNIXTIME(-1)));
+LEFT('1', DAY(FROM_UNIXTIME(-1)))
+NULL
+SELECT RIGHT('1', DAY(FROM_UNIXTIME(-1)));
+RIGHT('1', DAY(FROM_UNIXTIME(-1)))
+NULL
+SELECT REPEAT('1', DAY(FROM_UNIXTIME(-1)));
+REPEAT('1', DAY(FROM_UNIXTIME(-1)))
+NULL
+SELECT RPAD('hi', DAY(FROM_UNIXTIME(-1)),'?');
+RPAD('hi', DAY(FROM_UNIXTIME(-1)),'?')
+NULL
+SELECT LPAD('hi', DAY(FROM_UNIXTIME(-1)),'?');
+LPAD('hi', DAY(FROM_UNIXTIME(-1)),'?')
+NULL
 End of 5.1 tests
diff --git a/mysql-test/t/func_str.test b/mysql-test/t/func_str.test
index 92c4bae5327..9909974d3be 100644
--- a/mysql-test/t/func_str.test
+++ b/mysql-test/t/func_str.test
@@ -1380,4 +1380,15 @@ LOAD DATA INFILE 'bug58165.txt' INTO TABLE t1;
 SELECT * FROM t1;
 DROP TABLE t1;
 
+#
+# MDEV-759 lp:998340 - Valgrind complains on simple selects containing expression DAY(FROM_UNIXTIME(-1))
+#
+SELECT SUBSTRING('1', DAY(FROM_UNIXTIME(-1)));
+SELECT LEFT('1', DAY(FROM_UNIXTIME(-1)));
+SELECT RIGHT('1', DAY(FROM_UNIXTIME(-1)));
+SELECT REPEAT('1', DAY(FROM_UNIXTIME(-1)));
+SELECT RPAD('hi', DAY(FROM_UNIXTIME(-1)),'?');
+SELECT LPAD('hi', DAY(FROM_UNIXTIME(-1)),'?');
+
+
 --echo End of 5.1 tests
diff --git a/sql/item_strfunc.cc b/sql/item_strfunc.cc
index 4225687724f..9cc77849094 100644
--- a/sql/item_strfunc.cc
+++ b/sql/item_strfunc.cc
@@ -1167,7 +1167,7 @@ void Item_str_func::left_right_max_length()
   if (args[1]->const_item())
   {
     int length=(int) args[1]->val_int()*collation.collation->mbmaxlen;
-    if (length <= 0)
+    if (args[1]->null_value || length <= 0)
       max_length=0;
     else
       set_if_smaller(max_length,(uint) length);
@@ -1270,7 +1270,9 @@ void Item_func_substr::fix_length_and_dec()
   if (args[1]->const_item())
   {
     int32 start= (int32) args[1]->val_int();
-    if (start < 0)
+    if (args[1]->null_value)
+      max_length= 0;
+    else if (start < 0)
       max_length= ((uint)(-start) > max_length) ? 0 : (uint)(-start);
     else
       max_length-= min((uint)(start - 1), max_length);
@@ -1278,7 +1280,7 @@ void Item_func_substr::fix_length_and_dec()
   if (arg_count == 3 && args[2]->const_item())
   {
     int32 length= (int32) args[2]->val_int();
-    if (length <= 0)
+    if (args[2]->null_value || length <= 0)
       max_length=0; /* purecov: inspected */
     else
       set_if_smaller(max_length,(uint) length);
@@ -2411,7 +2413,9 @@ void Item_func_repeat::fix_length_and_dec()
 
     /* Assumes that the maximum length of a String is < INT_MAX32. */
     /* Set here so that rest of code sees out-of-bound value as such. */
-    if (count > INT_MAX32)
+    if (args[1]->null_value)
+      count= 0;
+    else if (count > INT_MAX32)
       count= INT_MAX32;
 
     ulonglong max_result_length= (ulonglong) args[0]->max_length * count;
@@ -2499,7 +2503,9 @@ void Item_func_rpad::fix_length_and_dec()
 
       /* Assumes that the maximum length of a String is < INT_MAX32. */
       /* Set here so that rest of code sees out-of-bound value as such. */
-      if (temp > INT_MAX32)
+      if (args[1]->null_value)
+        temp= 0;
+      else if (temp > INT_MAX32)
 	temp = INT_MAX32;
 
       length= temp * collation.collation->mbmaxlen;
@@ -2616,7 +2622,9 @@ void Item_func_lpad::fix_length_and_dec()
 
       /* Assumes that the maximum length of a String is < INT_MAX32. */
       /* Set here so that rest of code sees out-of-bound value as such. */
-      if (temp > INT_MAX32)
+      if (args[1]->null_value)
+        temp= 0;
+      else if (temp > INT_MAX32)
         temp= INT_MAX32;
 
       length= temp * collation.collation->mbmaxlen;