func_gconcat.result, func_gconcat.test:

  Added a test case for bug #7769.
item_sum.h:
  Fixed bug #7769: a crash for queries with group_concat and
  having when the query table was empty.
  The bug was due an unsafe dereferencing.

3 files changed, 15 insertions, 2 deletions

diff --git a/mysql-test/r/func_gconcat.result b/mysql-test/r/func_gconcat.result
index aa202823c77..390b33fdddc 100644
--- a/mysql-test/r/func_gconcat.result
+++ b/mysql-test/r/func_gconcat.result
@@ -457,3 +457,8 @@ group_concat(distinct b order by b)
 Warnings:
 Warning	1260	2 line(s) were cut by GROUP_CONCAT()
 drop table t1;
+CREATE TABLE t1 (id int);
+SELECT GROUP_CONCAT(id) AS gc FROM t1 HAVING gc IS NULL;
+gc
+NULL
+DROP TABLE t1;
diff --git a/mysql-test/t/func_gconcat.test b/mysql-test/t/func_gconcat.test
index e0737a42221..6a91a7ac9c7 100644
--- a/mysql-test/t/func_gconcat.test
+++ b/mysql-test/t/func_gconcat.test
@@ -277,3 +277,10 @@ select group_concat(b order by b) from t1 group by a;
 select group_concat(distinct b order by b) from t1 group by a;
 
 drop table t1;
+
+#
+# bug #7769: group_concat returning null is checked in having
+#
+CREATE TABLE t1 (id int);
+SELECT GROUP_CONCAT(id) AS gc FROM t1 HAVING gc IS NULL;
+DROP TABLE t1;
diff --git a/sql/item_sum.h b/sql/item_sum.h
index cec611b8854..d1e82387944 100644
--- a/sql/item_sum.h
+++ b/sql/item_sum.h
@@ -739,9 +739,10 @@ class Item_func_group_concat : public Item_sum
     String *res;
     char *end_ptr;
     int error;
-    res= val_str(&str_value);
+    if (!(res= val_str(&str_value)))
+      return (longlong) 0;
     end_ptr= (char*) res->ptr()+ res->length();
-    return res ? my_strtoll10(res->ptr(), &end_ptr, &error) : (longlong) 0;
+    return my_strtoll10(res->ptr(), &end_ptr, &error);
   }
   String* val_str(String* str);
   Item *copy_or_same(THD* thd);