Bug#44834 strxnmov is expected to behave as you'd expect

The problem: described in the bug report.
The fix:
--increase buffers where it's necessary
  (buffers which are used in stxnmov)
--decrease buffer lengths which are used


client/mysql.cc:
  --increase buffers where it's necessary
    (buffers which are used in stxnmov)
  --decrease buffer lengths which are used
    as argument for strxnmov function
sql/ha_ndbcluster.cc:
  --increase buffers where it's necessary
    (buffers which are used in stxnmov)
  --decrease buffer lengths which are used
    as argument for strxnmov function
sql/ha_ndbcluster_binlog.cc:
  --increase buffers where it's necessary
    (buffers which are used in stxnmov)
  --decrease buffer lengths which are used
    as argument for strxnmov function
sql/handler.cc:
  --increase buffers where it's necessary
    (buffers which are used in stxnmov)
  --decrease buffer lengths which are used
    as argument for strxnmov function
sql/log.cc:
  --increase buffers where it's necessary
    (buffers which are used in stxnmov)
  --decrease buffer lengths which are used
    as argument for strxnmov function
sql/mysqld.cc:
  removed unnecessary line
sql/parse_file.cc:
  --increase buffers where it's necessary
    (buffers which are used in stxnmov)
  --decrease buffer lengths which are used
    as argument for strxnmov function
sql/sql_acl.cc:
  --increase buffers where it's necessary
    (buffers which are used in stxnmov)
  --decrease buffer lengths which are used
    as argument for strxnmov function
sql/sql_base.cc:
  --increase buffers where it's necessary
    (buffers which are used in stxnmov)
  --decrease buffer lengths which are used
    as argument for strxnmov function
sql/sql_db.cc:
  --increase buffers where it's necessary
    (buffers which are used in stxnmov)
  --decrease buffer lengths which are used
    as argument for strxnmov function
sql/sql_delete.cc:
  --increase buffers where it's necessary
    (buffers which are used in stxnmov)
  --decrease buffer lengths which are used
    as argument for strxnmov function
sql/sql_partition.cc:
  --increase buffers where it's necessary
    (buffers which are used in stxnmov)
  --decrease buffer lengths which are used
    as argument for strxnmov function
sql/sql_rename.cc:
  --increase buffers where it's necessary
    (buffers which are used in stxnmov)
  --decrease buffer lengths which are used
    as argument for strxnmov function
sql/sql_show.cc:
  --increase buffers where it's necessary
    (buffers which are used in stxnmov)
  --decrease buffer lengths which are used
    as argument for strxnmov function
sql/sql_table.cc:
  --increase buffers where it's necessary
    (buffers which are used in stxnmov)
  --decrease buffer lengths which are used
    as argument for strxnmov function
sql/sql_view.cc:
  --increase buffers where it's necessary
    (buffers which are used in stxnmov)
  --decrease buffer lengths which are used
    as argument for strxnmov function

16 files changed, 132 insertions, 127 deletions

diff --git a/client/mysql.cc b/client/mysql.cc
index 732e38cd74d..4ab46ed1e7d 100644
--- a/client/mysql.cc
+++ b/client/mysql.cc
@@ -2732,7 +2732,7 @@ static int com_server_help(String *buffer __attribute__((unused)),
 {
   MYSQL_ROW cur;
   const char *server_cmd= buffer->ptr();
-  char cmd_buf[100];
+  char cmd_buf[100 + 1];
   MYSQL_RES *result;
   int error;
   
diff --git a/sql/ha_ndbcluster.cc b/sql/ha_ndbcluster.cc
index 3454f3558e8..ddb90427fdc 100644
--- a/sql/ha_ndbcluster.cc
+++ b/sql/ha_ndbcluster.cc
@@ -1247,7 +1247,7 @@ int ha_ndbcluster::add_index_handle(THD *thd, NDBDICT *dict, KEY *key_info,
   }
   if (idx_type == UNIQUE_ORDERED_INDEX || idx_type == UNIQUE_INDEX)
   {
-    char unique_index_name[FN_LEN];
+    char unique_index_name[FN_LEN + 1];
     static const char* unique_suffix= "$unique";
     m_has_unique_index= TRUE;
     strxnmov(unique_index_name, FN_LEN, index_name, unique_suffix, NullS);
@@ -5150,7 +5150,7 @@ int ha_ndbcluster::create(const char *name,
   uchar *data= NULL, *pack_data= NULL;
   bool create_from_engine= (create_info->table_options & HA_OPTION_CREATE_FROM_ENGINE);
   bool is_truncate= (thd->lex->sql_command == SQLCOM_TRUNCATE);
-  char tablespace[FN_LEN];
+  char tablespace[FN_LEN + 1];
   NdbDictionary::Table::SingleUserMode single_user_mode= NdbDictionary::Table::SingleUserModeLocked;
 
   DBUG_ENTER("ha_ndbcluster::create");
@@ -5613,7 +5613,7 @@ int ha_ndbcluster::create_index(const char *name, KEY *key_info,
                                 NDB_INDEX_TYPE idx_type, uint idx_no)
 {
   int error= 0;
-  char unique_name[FN_LEN];
+  char unique_name[FN_LEN + 1];
   static const char* unique_suffix= "$unique";
   DBUG_ENTER("ha_ndbcluster::create_ordered_index");
   DBUG_PRINT("info", ("Creating index %u: %s", idx_no, name));  
@@ -6661,7 +6661,7 @@ int ndbcluster_discover(handlerton *hton, THD* thd, const char *db,
   size_t len;
   uchar* data= NULL;
   Ndb* ndb;
-  char key[FN_REFLEN];
+  char key[FN_REFLEN + 1];
   DBUG_ENTER("ndbcluster_discover");
   DBUG_PRINT("enter", ("db: %s, name: %s", db, name)); 
 
@@ -6672,7 +6672,7 @@ int ndbcluster_discover(handlerton *hton, THD* thd, const char *db,
     ERR_RETURN(ndb->getNdbError());
   }
   NDBDICT* dict= ndb->getDictionary();
-  build_table_filename(key, sizeof(key), db, name, "", 0);
+  build_table_filename(key, sizeof(key) - 1, db, name, "", 0);
   /* ndb_share reference temporary */
   NDB_SHARE *share= get_share(key, 0, FALSE);
   if (share)
@@ -6837,9 +6837,9 @@ int ndbcluster_drop_database_impl(const char *path)
     drop_list.push_back(thd->strdup(elmt.name));
   }
   // Drop any tables belonging to database
-  char full_path[FN_REFLEN];
+  char full_path[FN_REFLEN + 1];
   char *tmp= full_path +
-    build_table_filename(full_path, sizeof(full_path), dbname, "", "", 0);
+    build_table_filename(full_path, sizeof(full_path) - 1, dbname, "", "", 0);
   if (ndb->setDatabaseName(dbname))
   {
     ERR_RETURN(ndb->getNdbError());
@@ -6908,7 +6908,7 @@ int ndb_create_table_from_engine(THD *thd, const char *db,
 int ndbcluster_find_all_files(THD *thd)
 {
   Ndb* ndb;
-  char key[FN_REFLEN];
+  char key[FN_REFLEN + 1];
   NDBDICT *dict;
   int unhandled, retries= 5, skipped;
   DBUG_ENTER("ndbcluster_find_all_files");
@@ -6966,7 +6966,7 @@ int ndbcluster_find_all_files(THD *thd)
     
       /* check if database exists */
       char *end= key +
-        build_table_filename(key, sizeof(key), elmt.database, "", "", 0);
+        build_table_filename(key, sizeof(key) - 1, elmt.database, "", "", 0);
       if (my_access(key, F_OK))
       {
         /* no such database defined, skip table */
@@ -7047,7 +7047,7 @@ int ndbcluster_find_files(handlerton *hton, THD *thd,
   { // extra bracket to avoid gcc 2.95.3 warning
   uint i;
   Ndb* ndb;
-  char name[FN_REFLEN];
+  char name[FN_REFLEN + 1];
   HASH ndb_tables, ok_tables;
   NDBDICT::List list;
 
@@ -7117,7 +7117,8 @@ int ndbcluster_find_files(handlerton *hton, THD *thd,
     DBUG_PRINT("info", ("%s", file_name->str));
     if (hash_search(&ndb_tables, (uchar*) file_name->str, file_name->length))
     {
-      build_table_filename(name, sizeof(name), db, file_name->str, reg_ext, 0);
+      build_table_filename(name, sizeof(name) - 1, db,
+                           file_name->str, reg_ext, 0);
       if (my_access(name, F_OK))
       {
         pthread_mutex_lock(&LOCK_open);
@@ -7139,7 +7140,8 @@ int ndbcluster_find_files(handlerton *hton, THD *thd,
     }
     
     // Check for .ndb file with this name
-    build_table_filename(name, sizeof(name), db, file_name->str, ha_ndb_ext, 0);
+    build_table_filename(name, sizeof(name) - 1, db,
+                         file_name->str, ha_ndb_ext, 0);
     DBUG_PRINT("info", ("Check access for %s", name));
     if (my_access(name, F_OK))
     {
@@ -7182,7 +7184,7 @@ int ndbcluster_find_files(handlerton *hton, THD *thd,
   /* setup logging to binlog for all discovered tables */
   {
     char *end, *end1= name +
-      build_table_filename(name, sizeof(name), db, "", "", 0);
+      build_table_filename(name, sizeof(name) - 1, db, "", "", 0);
     for (i= 0; i < ok_tables.records; i++)
     {
       file_name_str= (char*)hash_element(&ok_tables, i);
@@ -7204,7 +7206,8 @@ int ndbcluster_find_files(handlerton *hton, THD *thd,
     file_name_str= (char*) hash_element(&ndb_tables, i);
     if (!hash_search(&ok_tables, (uchar*) file_name_str, strlen(file_name_str)))
     {
-      build_table_filename(name, sizeof(name), db, file_name_str, reg_ext, 0);
+      build_table_filename(name, sizeof(name) - 1,
+                           db, file_name_str, reg_ext, 0);
       if (my_access(name, F_OK))
       {
         DBUG_PRINT("info", ("%s must be discovered", file_name_str));
@@ -7584,7 +7587,7 @@ void ndbcluster_print_error(int error, const NdbOperation *error_op)
 void ha_ndbcluster::set_dbname(const char *path_name, char *dbname)
 {
   char *end, *ptr, *tmp_name;
-  char tmp_buff[FN_REFLEN];
+  char tmp_buff[FN_REFLEN + 1];
  
   tmp_name= tmp_buff;
   /* Scan name from the end */
@@ -7610,7 +7613,7 @@ void ha_ndbcluster::set_dbname(const char *path_name, char *dbname)
     ptr++;
   }
 #endif
-  filename_to_tablename(tmp_name, dbname, FN_REFLEN);
+  filename_to_tablename(tmp_name, dbname, sizeof(tmp_buff) - 1);
 }
 
 /**
@@ -7630,7 +7633,7 @@ void
 ha_ndbcluster::set_tabname(const char *path_name, char * tabname)
 {
   char *end, *ptr, *tmp_name;
-  char tmp_buff[FN_REFLEN];
+  char tmp_buff[FN_REFLEN + 1];
 
   tmp_name= tmp_buff;
   /* Scan name from the end */
@@ -7651,7 +7654,7 @@ ha_ndbcluster::set_tabname(const char *path_name, char * tabname)
     ptr++;
   }
 #endif
-  filename_to_tablename(tmp_name, tabname, FN_REFLEN);
+  filename_to_tablename(tmp_name, tabname, sizeof(tmp_buff) - 1);
 }
 
 /**
@@ -7837,11 +7840,12 @@ uint8 ha_ndbcluster::table_cache_type()
 uint ndb_get_commitcount(THD *thd, char *dbname, char *tabname,
                          Uint64 *commit_count)
 {
-  char name[FN_REFLEN];
+  char name[FN_REFLEN + 1];
   NDB_SHARE *share;
   DBUG_ENTER("ndb_get_commitcount");
 
-  build_table_filename(name, sizeof(name), dbname, tabname, "", 0);
+  build_table_filename(name, sizeof(name) - 1,
+                       dbname, tabname, "", 0);
   DBUG_PRINT("enter", ("name: %s", name));
   pthread_mutex_lock(&ndbcluster_mutex);
   if (!(share=(NDB_SHARE*) hash_search(&ndbcluster_open_tables,
@@ -9945,7 +9949,7 @@ bool ha_ndbcluster::check_if_incompatible_data(HA_CREATE_INFO *create_info,
       ai=1;
   }
 
-  char tablespace_name[FN_LEN]; 
+  char tablespace_name[FN_LEN + 1]; 
   if (get_tablespace_name(current_thd, tablespace_name, FN_LEN))
   {
     if (create_info->tablespace) 
diff --git a/sql/ha_ndbcluster_binlog.cc b/sql/ha_ndbcluster_binlog.cc
index a0c74b60f84..f705af8bf47 100644
--- a/sql/ha_ndbcluster_binlog.cc
+++ b/sql/ha_ndbcluster_binlog.cc
@@ -788,7 +788,7 @@ static int ndbcluster_create_ndb_apply_status_table(THD *thd)
   if (g_ndb_cluster_connection->get_no_ready() <= 0)
     DBUG_RETURN(0);
 
-  char buf[1024], *end;
+  char buf[1024 + 1], *end;
 
   if (ndb_extra_logging)
     sql_print_information("NDB: Creating " NDB_REP_DB "." NDB_APPLY_TABLE);
@@ -798,7 +798,7 @@ static int ndbcluster_create_ndb_apply_status_table(THD *thd)
     if so, remove it since there is none in Ndb
   */
   {
-    build_table_filename(buf, sizeof(buf),
+    build_table_filename(buf, sizeof(buf) - 1,
                          NDB_REP_DB, NDB_APPLY_TABLE, reg_ext, 0);
     my_delete(buf, MYF(0));
   }
@@ -846,7 +846,7 @@ static int ndbcluster_create_schema_table(THD *thd)
   if (g_ndb_cluster_connection->get_no_ready() <= 0)
     DBUG_RETURN(0);
 
-  char buf[1024], *end;
+  char buf[1024 + 1], *end;
 
   if (ndb_extra_logging)
     sql_print_information("NDB: Creating " NDB_REP_DB "." NDB_SCHEMA_TABLE);
@@ -856,7 +856,7 @@ static int ndbcluster_create_schema_table(THD *thd)
     if so, remove it since there is none in Ndb
   */
   {
-    build_table_filename(buf, sizeof(buf),
+    build_table_filename(buf, sizeof(buf) - 1,
                          NDB_REP_DB, NDB_SCHEMA_TABLE, reg_ext, 0);
     my_delete(buf, MYF(0));
   }
@@ -1321,8 +1321,8 @@ int ndbcluster_log_schema_op(THD *thd, NDB_SHARE *share,
 
   NDB_SCHEMA_OBJECT *ndb_schema_object;
   {
-    char key[FN_REFLEN];
-    build_table_filename(key, sizeof(key), db, table_name, "", 0);
+    char key[FN_REFLEN + 1];
+    build_table_filename(key, sizeof(key) - 1, db, table_name, "", 0);
     ndb_schema_object= ndb_get_schema_object(key, TRUE, FALSE);
   }
 
@@ -1674,7 +1674,7 @@ ndb_handle_schema_change(THD *thd, Ndb *ndb, NdbEventOperation *pOp,
   if (is_remote_change && is_online_alter_table)
   {
     const char *tabname= table_share->table_name.str;
-    char key[FN_REFLEN];
+    char key[FN_REFLEN + 1];
     uchar *data= 0, *pack_data= 0;
     size_t length, pack_length;
     int error;
@@ -1683,7 +1683,7 @@ ndb_handle_schema_change(THD *thd, Ndb *ndb, NdbEventOperation *pOp,
     
     DBUG_PRINT("info", ("Detected frm change of table %s.%s",
                         dbname, tabname));
-    build_table_filename(key, FN_LEN-1, dbname, tabname, NullS, 0);
+    build_table_filename(key, FN_LEN - 1, dbname, tabname, NullS, 0);
     /*
       If the there is no local table shadowing the altered table and 
       it has an frm that is different than the one on disk then 
@@ -1926,8 +1926,8 @@ ndb_binlog_thread_handle_schema_event(THD *thd, Ndb *ndb,
           break;
 	case SOT_TRUNCATE_TABLE:
         {
-          char key[FN_REFLEN];
-          build_table_filename(key, sizeof(key),
+          char key[FN_REFLEN + 1];
+          build_table_filename(key, sizeof(key) - 1,
                                schema->db, schema->name, "", 0);
           /* ndb_share reference temporary, free below */
           NDB_SHARE *share= get_share(key, 0, FALSE, FALSE);
@@ -2173,8 +2173,8 @@ ndb_binlog_thread_handle_schema_event_post_epoch(THD *thd,
     int log_query= 0;
     {
       enum SCHEMA_OP_TYPE schema_type= (enum SCHEMA_OP_TYPE)schema->type;
-      char key[FN_REFLEN];
-      build_table_filename(key, sizeof(key), schema->db, schema->name, "", 0);
+      char key[FN_REFLEN + 1];
+      build_table_filename(key, sizeof(key) - 1, schema->db, schema->name, "", 0);
       if (schema_type == SOT_CLEAR_SLOCK)
       {
         pthread_mutex_lock(&ndbcluster_mutex);
@@ -2508,8 +2508,8 @@ ndb_rep_event_name(String *event_name,const char *db, const char *tbl)
 bool
 ndbcluster_check_if_local_table(const char *dbname, const char *tabname)
 {
-  char key[FN_REFLEN];
-  char ndb_file[FN_REFLEN];
+  char key[FN_REFLEN + 1];
+  char ndb_file[FN_REFLEN + 1];
 
   DBUG_ENTER("ndbcluster_check_if_local_table");
   build_table_filename(key, FN_LEN-1, dbname, tabname, reg_ext, 0);
@@ -2534,9 +2534,9 @@ ndbcluster_check_if_local_tables_in_db(THD *thd, const char *dbname)
   DBUG_PRINT("info", ("Looking for files in directory %s", dbname));
   LEX_STRING *tabname;
   List<LEX_STRING> files;
-  char path[FN_REFLEN];
+  char path[FN_REFLEN + 1];
 
-  build_table_filename(path, sizeof(path), dbname, "", "", 0);
+  build_table_filename(path, sizeof(path) - 1, dbname, "", "", 0);
   if (find_files(thd, &files, dbname, path, NullS, 0) != FIND_FILES_OK)
   {
     DBUG_PRINT("info", ("Failed to find files"));
diff --git a/sql/handler.cc b/sql/handler.cc
index 058a43eed8d..7e584b8fcf3 100644
--- a/sql/handler.cc
+++ b/sql/handler.cc
@@ -3582,7 +3582,7 @@ int ha_create_table_from_engine(THD* thd, const char *db, const char *name)
   int error;
   uchar *frmblob;
   size_t frmlen;
-  char path[FN_REFLEN];
+  char path[FN_REFLEN + 1];
   HA_CREATE_INFO create_info;
   TABLE table;
   TABLE_SHARE share;
@@ -3601,7 +3601,7 @@ int ha_create_table_from_engine(THD* thd, const char *db, const char *name)
     frmblob and frmlen are set, write the frm to disk
   */
 
-  build_table_filename(path, FN_REFLEN-1, db, name, "", 0);
+  build_table_filename(path, sizeof(path) - 1, db, name, "", 0);
   // Save the frm file
   error= writefrm(path, frmblob, frmlen);
   my_free(frmblob, MYF(0));
@@ -4778,7 +4778,7 @@ fl_log_iterator_buffer_init(struct handler_iterator *iterator)
   if ((ptr= (uchar*)my_malloc(ALIGN_SIZE(sizeof(fl_buff)) +
                              ((ALIGN_SIZE(sizeof(LEX_STRING)) +
                                sizeof(enum log_status) +
-                               + FN_REFLEN) *
+                               + FN_REFLEN + 1) *
                               (uint) dirp->number_off_files),
                              MYF(0))) == 0)
   {
@@ -4806,7 +4806,7 @@ fl_log_iterator_buffer_init(struct handler_iterator *iterator)
     name_ptr= strxnmov(buff->names[buff->entries].str= name_ptr,
                        FN_REFLEN, fl_dir, file->name, NullS);
     buff->names[buff->entries].length= (name_ptr -
-                                        buff->names[buff->entries].str) - 1;
+                                        buff->names[buff->entries].str);
     buff->statuses[buff->entries]= st;
     buff->entries++;
   }
diff --git a/sql/log.cc b/sql/log.cc
index 1ed3b35a8a9..8bb6ba8e9c6 100644
--- a/sql/log.cc
+++ b/sql/log.cc
@@ -956,7 +956,7 @@ bool LOGGER::slow_log_print(THD *thd, const char *query, uint query_length,
   bool error= FALSE;
   Log_event_handler **current_handler;
   bool is_command= FALSE;
-  char user_host_buff[MAX_USER_HOST_SIZE];
+  char user_host_buff[MAX_USER_HOST_SIZE + 1];
   Security_context *sctx= thd->security_ctx;
   uint user_host_len= 0;
   ulonglong query_utime, lock_utime;
@@ -1022,7 +1022,7 @@ bool LOGGER::general_log_write(THD *thd, enum enum_server_command command,
 {
   bool error= FALSE;
   Log_event_handler **current_handler= general_log_handler_list;
-  char user_host_buff[MAX_USER_HOST_SIZE];
+  char user_host_buff[MAX_USER_HOST_SIZE + 1];
   Security_context *sctx= thd->security_ctx;
   ulong id;
   uint user_host_len= 0;
diff --git a/sql/mysqld.cc b/sql/mysqld.cc
index 239fff01071..1d18226ab45 100644
--- a/sql/mysqld.cc
+++ b/sql/mysqld.cc
@@ -1664,7 +1664,6 @@ static void network_init(void)
       opt_enable_named_pipe)
   {
     
-    pipe_name[sizeof(pipe_name)-1]= 0;		/* Safety if too long string */
     strxnmov(pipe_name, sizeof(pipe_name)-1, "\\\\.\\pipe\\",
 	     mysqld_unix_port, NullS);
     bzero((char*) &saPipeSecurity, sizeof(saPipeSecurity));
diff --git a/sql/parse_file.cc b/sql/parse_file.cc
index f2dbeba1bbf..3d65fa1de31 100644
--- a/sql/parse_file.cc
+++ b/sql/parse_file.cc
@@ -231,7 +231,7 @@ sql_create_definition_file(const LEX_STRING *dir, const LEX_STRING *file_name,
       including dir name, file name itself, and an extension,
       and with unpack_filename() executed over it.
     */    
-    path_end= strxnmov(path, FN_REFLEN, file_name->str, NullS) - path;
+    path_end= strxnmov(path, sizeof(path) - 1, file_name->str, NullS) - path;
   }
 
   // temporary file name
@@ -314,7 +314,7 @@ my_bool rename_in_schema_file(THD *thd,
                               const char *schema, const char *old_name, 
                               const char *new_db, const char *new_name)
 {
-  char old_path[FN_REFLEN], new_path[FN_REFLEN], arc_path[FN_REFLEN];
+  char old_path[FN_REFLEN + 1], new_path[FN_REFLEN + 1], arc_path[FN_REFLEN + 1];
 
   build_table_filename(old_path, sizeof(old_path) - 1,
                        schema, old_name, reg_ext, 0);
diff --git a/sql/sql_acl.cc b/sql/sql_acl.cc
index a1164ec6448..ab18a2d1d04 100644
--- a/sql/sql_acl.cc
+++ b/sql/sql_acl.cc
@@ -2995,8 +2995,8 @@ int mysql_table_grant(THD *thd, TABLE_LIST *table_list,
     {
       if (!(rights & CREATE_ACL))
       {
-        char buf[FN_REFLEN];
-        build_table_filename(buf, sizeof(buf), table_list->db,
+        char buf[FN_REFLEN + 1];
+        build_table_filename(buf, sizeof(buf) - 1, table_list->db,
                              table_list->table_name, reg_ext, 0);
         fn_format(buf, buf, "", "", MY_UNPACK_FILENAME  | MY_RESOLVE_SYMLINKS |
                                     MY_RETURN_REAL_PATH | MY_APPEND_EXT);
diff --git a/sql/sql_base.cc b/sql/sql_base.cc
index 6b3f75376a3..134b45a9100 100644
--- a/sql/sql_base.cc
+++ b/sql/sql_base.cc
@@ -2432,7 +2432,7 @@ bool lock_table_name_if_not_cached(THD *thd, const char *db,
 
 bool check_if_table_exists(THD *thd, TABLE_LIST *table, bool *exists)
 {
-  char path[FN_REFLEN];
+  char path[FN_REFLEN + 1];
   int rc;
   DBUG_ENTER("check_if_table_exists");
 
@@ -2649,7 +2649,7 @@ TABLE *open_table(THD *thd, TABLE_LIST *table_list, MEM_ROOT *mem_root,
       real fix will be made after definition cache will be made)
     */
     {
-      char path[FN_REFLEN];
+      char path[FN_REFLEN + 1];
       enum legacy_db_type not_used;
       build_table_filename(path, sizeof(path) - 1,
                            table_list->db, table_list->table_name, reg_ext, 0);
@@ -6340,7 +6340,7 @@ find_field_in_tables(THD *thd, Item_ident *item,
       (report_error == REPORT_ALL_ERRORS ||
        report_error == REPORT_EXCEPT_NON_UNIQUE))
   {
-    char buff[NAME_LEN*2+1];
+    char buff[NAME_LEN*2 + 2];
     if (db && db[0])
     {
       strxnmov(buff,sizeof(buff)-1,db,".",table_name,NullS);
diff --git a/sql/sql_db.cc b/sql/sql_db.cc
index 7f77e60138b..98d17fdd318 100644
--- a/sql/sql_db.cc
+++ b/sql/sql_db.cc
@@ -537,13 +537,13 @@ err1:
 bool load_db_opt_by_name(THD *thd, const char *db_name,
                          HA_CREATE_INFO *db_create_info)
 {
-  char db_opt_path[FN_REFLEN];
+  char db_opt_path[FN_REFLEN + 1];
 
   /*
     Pass an empty file name, and the database options file name as extension
     to avoid table name to file name encoding.
   */
-  (void) build_table_filename(db_opt_path, sizeof(db_opt_path),
+  (void) build_table_filename(db_opt_path, sizeof(db_opt_path) - 1,
                               db_name, "", MY_DB_OPT_FILE, 0);
 
   return load_db_opt(thd, db_opt_path, db_create_info);
@@ -645,7 +645,7 @@ int mysql_create_db(THD *thd, char *db, HA_CREATE_INFO *create_info,
   VOID(pthread_mutex_lock(&LOCK_mysql_create_db));
 
   /* Check directory */
-  path_len= build_table_filename(path, sizeof(path), db, "", "", 0);
+  path_len= build_table_filename(path, sizeof(path) - 1, db, "", "", 0);
   path[path_len-1]= 0;                    // Remove last '/' from path
 
   if (my_stat(path,&stat_info,MYF(0)))
@@ -791,7 +791,7 @@ bool mysql_alter_db(THD *thd, const char *db, HA_CREATE_INFO *create_info)
      We pass MY_DB_OPT_FILE as "extension" to avoid
      "table name to file name" encoding.
   */
-  build_table_filename(path, sizeof(path), db, "", MY_DB_OPT_FILE, 0);
+  build_table_filename(path, sizeof(path) - 1, db, "", MY_DB_OPT_FILE, 0);
   if ((error=write_db_opt(thd, path, create_info)))
     goto exit;
 
@@ -884,7 +884,7 @@ bool mysql_rm_db(THD *thd,char *db,bool if_exists, bool silent)
 
   VOID(pthread_mutex_lock(&LOCK_mysql_create_db));
 
-  length= build_table_filename(path, sizeof(path), db, "", "", 0);
+  length= build_table_filename(path, sizeof(path) - 1, db, "", "", 0);
   strmov(path+length, MY_DB_OPT_FILE);		// Append db option file name
   del_dbopt(path);				// Remove dboption hash entry
   path[length]= '\0';				// Remove file name
@@ -1841,7 +1841,7 @@ bool mysql_upgrade_db(THD *thd, LEX_STRING *old_db)
     for (uint idx=0 ; idx < nfiles && !thd->killed ; idx++)
     {
       FILEINFO *file= dirp->dir_entry + idx;
-      char *extension, tname[FN_REFLEN];
+      char *extension, tname[FN_REFLEN + 1];
       LEX_STRING table_str;
       DBUG_PRINT("info",("Examining: %s", file->name));
 
@@ -1930,7 +1930,7 @@ bool mysql_upgrade_db(THD *thd, LEX_STRING *old_db)
     for (uint idx=0 ; idx < nfiles ; idx++)
     {
       FILEINFO *file= dirp->dir_entry + idx;
-      char oldname[FN_REFLEN], newname[FN_REFLEN];
+      char oldname[FN_REFLEN + 1], newname[FN_REFLEN + 1];
       DBUG_PRINT("info",("Examining: %s", file->name));
 
       /* skiping . and .. and MY_DB_OPT_FILE */
@@ -2000,10 +2000,10 @@ exit:
 
 bool check_db_dir_existence(const char *db_name)
 {
-  char db_dir_path[FN_REFLEN];
+  char db_dir_path[FN_REFLEN + 1];
   uint db_dir_path_len;
 
-  db_dir_path_len= build_table_filename(db_dir_path, sizeof(db_dir_path),
+  db_dir_path_len= build_table_filename(db_dir_path, sizeof(db_dir_path) - 1,
                                         db_name, "", "", 0);
 
   if (db_dir_path_len && db_dir_path[db_dir_path_len - 1] == FN_LIBCHAR)
diff --git a/sql/sql_delete.cc b/sql/sql_delete.cc
index b20ff78b9ba..677098d275a 100644
--- a/sql/sql_delete.cc
+++ b/sql/sql_delete.cc
@@ -1051,7 +1051,7 @@ static bool mysql_truncate_by_delete(THD *thd, TABLE_LIST *table_list)
 bool mysql_truncate(THD *thd, TABLE_LIST *table_list, bool dont_send_ok)
 {
   HA_CREATE_INFO create_info;
-  char path[FN_REFLEN];
+  char path[FN_REFLEN + 1];
   TABLE *table;
   bool error;
   uint path_length;
@@ -1088,7 +1088,7 @@ bool mysql_truncate(THD *thd, TABLE_LIST *table_list, bool dont_send_ok)
     goto end;
   }
 
-  path_length= build_table_filename(path, sizeof(path), table_list->db,
+  path_length= build_table_filename(path, sizeof(path) - 1, table_list->db,
                                     table_list->table_name, reg_ext, 0);
 
   if (!dont_send_ok)
diff --git a/sql/sql_partition.cc b/sql/sql_partition.cc
index 4a50650b6f4..3713a10997d 100644
--- a/sql/sql_partition.cc
+++ b/sql/sql_partition.cc
@@ -5090,7 +5090,7 @@ static bool mysql_change_partitions(ALTER_PARTITION_PARAM_TYPE *lpt)
   handler *file= lpt->table->file;
   DBUG_ENTER("mysql_change_partitions");
 
-  build_table_filename(path, sizeof(path), lpt->db, lpt->table_name, "", 0);
+  build_table_filename(path, sizeof(path) - 1, lpt->db, lpt->table_name, "", 0);
   if ((error= file->ha_change_partitions(lpt->create_info, path, &lpt->copied,
                                          &lpt->deleted, lpt->pack_frm_data,
                                          lpt->pack_frm_len)))
@@ -5130,7 +5130,7 @@ static bool mysql_rename_partitions(ALTER_PARTITION_PARAM_TYPE *lpt)
   int error;
   DBUG_ENTER("mysql_rename_partitions");
 
-  build_table_filename(path, sizeof(path), lpt->db, lpt->table_name, "", 0);
+  build_table_filename(path, sizeof(path) - 1, lpt->db, lpt->table_name, "", 0);
   if ((error= lpt->table->file->ha_rename_partitions(path)))
   {
     if (error != 1)
@@ -5171,7 +5171,7 @@ static bool mysql_drop_partitions(ALTER_PARTITION_PARAM_TYPE *lpt)
   int error;
   DBUG_ENTER("mysql_drop_partitions");
 
-  build_table_filename(path, sizeof(path), lpt->db, lpt->table_name, "", 0);
+  build_table_filename(path, sizeof(path) - 1, lpt->db, lpt->table_name, "", 0);
   if ((error= lpt->table->file->ha_drop_partitions(path)))
   {
     lpt->table->file->print_error(error, MYF(0));
@@ -5516,10 +5516,10 @@ static bool write_log_drop_shadow_frm(ALTER_PARTITION_PARAM_TYPE *lpt)
   partition_info *part_info= lpt->part_info;
   DDL_LOG_MEMORY_ENTRY *log_entry;
   DDL_LOG_MEMORY_ENTRY *exec_log_entry= NULL;
-  char shadow_path[FN_REFLEN];
+  char shadow_path[FN_REFLEN + 1];
   DBUG_ENTER("write_log_drop_shadow_frm");
 
-  build_table_shadow_filename(shadow_path, sizeof(shadow_path), lpt);
+  build_table_shadow_filename(shadow_path, sizeof(shadow_path) - 1, lpt);
   pthread_mutex_lock(&LOCK_gdl);
   if (write_log_replace_delete_frm(lpt, 0UL, NULL,
                                   (const char*)shadow_path, FALSE))
@@ -5559,15 +5559,15 @@ static bool write_log_rename_frm(ALTER_PARTITION_PARAM_TYPE *lpt)
   partition_info *part_info= lpt->part_info;
   DDL_LOG_MEMORY_ENTRY *log_entry;
   DDL_LOG_MEMORY_ENTRY *exec_log_entry= part_info->exec_log_entry;
-  char path[FN_REFLEN];
-  char shadow_path[FN_REFLEN];
+  char path[FN_REFLEN + 1];
+  char shadow_path[FN_REFLEN + 1];
   DDL_LOG_MEMORY_ENTRY *old_first_log_entry= part_info->first_log_entry;
   DBUG_ENTER("write_log_rename_frm");
 
   part_info->first_log_entry= NULL;
-  build_table_filename(path, sizeof(path), lpt->db,
+  build_table_filename(path, sizeof(path) - 1, lpt->db,
                        lpt->table_name, "", 0);
-  build_table_shadow_filename(shadow_path, sizeof(shadow_path), lpt);
+  build_table_shadow_filename(shadow_path, sizeof(shadow_path) - 1, lpt);
   pthread_mutex_lock(&LOCK_gdl);
   if (write_log_replace_delete_frm(lpt, 0UL, shadow_path, path, TRUE))
     goto error;
@@ -5610,16 +5610,16 @@ static bool write_log_drop_partition(ALTER_PARTITION_PARAM_TYPE *lpt)
   partition_info *part_info= lpt->part_info;
   DDL_LOG_MEMORY_ENTRY *log_entry;
   DDL_LOG_MEMORY_ENTRY *exec_log_entry= part_info->exec_log_entry;
-  char tmp_path[FN_REFLEN];
-  char path[FN_REFLEN];
+  char tmp_path[FN_REFLEN + 1];
+  char path[FN_REFLEN + 1];
   uint next_entry= 0;
   DDL_LOG_MEMORY_ENTRY *old_first_log_entry= part_info->first_log_entry;
   DBUG_ENTER("write_log_drop_partition");
 
   part_info->first_log_entry= NULL;
-  build_table_filename(path, sizeof(path), lpt->db,
+  build_table_filename(path, sizeof(path) - 1, lpt->db,
                        lpt->table_name, "", 0);
-  build_table_filename(tmp_path, sizeof(tmp_path), lpt->db,
+  build_table_filename(tmp_path, sizeof(tmp_path) - 1, lpt->db,
                        lpt->table_name, "#", 0);
   pthread_mutex_lock(&LOCK_gdl);
   if (write_log_dropped_partitions(lpt, &next_entry, (const char*)path,
@@ -5669,14 +5669,14 @@ static bool write_log_add_change_partition(ALTER_PARTITION_PARAM_TYPE *lpt)
   partition_info *part_info= lpt->part_info;
   DDL_LOG_MEMORY_ENTRY *log_entry;
   DDL_LOG_MEMORY_ENTRY *exec_log_entry= NULL;
-  char tmp_path[FN_REFLEN];
-  char path[FN_REFLEN];
+  char tmp_path[FN_REFLEN + 1];
+  char path[FN_REFLEN + 1];
   uint next_entry= 0;
   DBUG_ENTER("write_log_add_change_partition");
 
-  build_table_filename(path, sizeof(path), lpt->db,
+  build_table_filename(path, sizeof(path) - 1, lpt->db,
                        lpt->table_name, "", 0);
-  build_table_filename(tmp_path, sizeof(tmp_path), lpt->db,
+  build_table_filename(tmp_path, sizeof(tmp_path) - 1, lpt->db,
                        lpt->table_name, "#", 0);
   pthread_mutex_lock(&LOCK_gdl);
   if (write_log_dropped_partitions(lpt, &next_entry, (const char*)path,
@@ -5723,16 +5723,16 @@ static bool write_log_final_change_partition(ALTER_PARTITION_PARAM_TYPE *lpt)
   partition_info *part_info= lpt->part_info;
   DDL_LOG_MEMORY_ENTRY *log_entry;
   DDL_LOG_MEMORY_ENTRY *exec_log_entry= part_info->exec_log_entry;
-  char path[FN_REFLEN];
-  char shadow_path[FN_REFLEN];
+  char path[FN_REFLEN + 1];
+  char shadow_path[FN_REFLEN + 1];
   DDL_LOG_MEMORY_ENTRY *old_first_log_entry= part_info->first_log_entry;
   uint next_entry= 0;
   DBUG_ENTER("write_log_final_change_partition");
 
   part_info->first_log_entry= NULL;
-  build_table_filename(path, sizeof(path), lpt->db,
+  build_table_filename(path, sizeof(path) - 1, lpt->db,
                        lpt->table_name, "", 0);
-  build_table_shadow_filename(shadow_path, sizeof(shadow_path), lpt);
+  build_table_shadow_filename(shadow_path, sizeof(shadow_path) - 1, lpt);
   pthread_mutex_lock(&LOCK_gdl);
   if (write_log_dropped_partitions(lpt, &next_entry, (const char*)path,
                       lpt->alter_info->flags & ALTER_REORGANIZE_PARTITION))
diff --git a/sql/sql_rename.cc b/sql/sql_rename.cc
index 7cc9130cc4a..0e0b8eb60b9 100644
--- a/sql/sql_rename.cc
+++ b/sql/sql_rename.cc
@@ -244,7 +244,7 @@ do_rename(THD *thd, TABLE_LIST *ren_table, char *new_db, char *new_table_name,
           char *new_table_alias, bool skip_error)
 {
   int rc= 1;
-  char name[FN_REFLEN];
+  char name[FN_REFLEN + 1];
   const char *new_alias, *old_alias;
   frm_type_enum frm_type;
   enum legacy_db_type table_type;
@@ -263,14 +263,14 @@ do_rename(THD *thd, TABLE_LIST *ren_table, char *new_db, char *new_table_name,
   }
   DBUG_ASSERT(new_alias);
 
-  build_table_filename(name, sizeof(name),
+  build_table_filename(name, sizeof(name) - 1,
                        new_db, new_alias, reg_ext, 0);
   if (!access(name,F_OK))
   {
     my_error(ER_TABLE_EXISTS_ERROR, MYF(0), new_alias);
     DBUG_RETURN(1);			// This can't be skipped
   }
-  build_table_filename(name, sizeof(name),
+  build_table_filename(name, sizeof(name) - 1,
                        ren_table->db, old_alias, reg_ext, 0);
 
   frm_type= mysql_frm_type(thd, name, &table_type);
diff --git a/sql/sql_show.cc b/sql/sql_show.cc
index a4fc10002dd..3964e38db5e 100644
--- a/sql/sql_show.cc
+++ b/sql/sql_show.cc
@@ -2819,8 +2819,8 @@ make_table_name_list(THD *thd, List<LEX_STRING> *table_names, LEX *lex,
                      LOOKUP_FIELD_VALUES *lookup_field_vals,
                      bool with_i_schema, LEX_STRING *db_name)
 {
-  char path[FN_REFLEN];
-  build_table_filename(path, sizeof(path), db_name->str, "", "", 0);
+  char path[FN_REFLEN + 1];
+  build_table_filename(path, sizeof(path) - 1, db_name->str, "", "", 0);
   if (!lookup_field_vals->wild_table_value &&
       lookup_field_vals->table_value.str)
   {
@@ -2982,8 +2982,8 @@ static int fill_schema_table_names(THD *thd, TABLE *table,
   else
   {
     enum legacy_db_type not_used;
-    char path[FN_REFLEN];
-    (void) build_table_filename(path, sizeof(path), db_name->str, 
+    char path[FN_REFLEN + 1];
+    (void) build_table_filename(path, sizeof(path) - 1, db_name->str, 
                                 table_name->str, reg_ext, 0);
     switch (mysql_frm_type(thd, path, &not_used)) {
     case FRMTYPE_ERROR:
@@ -3470,7 +3470,7 @@ int fill_schema_schemata(THD *thd, TABLE_LIST *tables, COND *cond)
     MY_STAT stat_info;
     if (!lookup_field_vals.db_value.str[0])
       DBUG_RETURN(0);
-    path_len= build_table_filename(path, sizeof(path),
+    path_len= build_table_filename(path, sizeof(path) - 1,
                                    lookup_field_vals.db_value.str, "", "", 0);
     path[path_len-1]= 0;
     if (!my_stat(path,&stat_info,MYF(0)))
diff --git a/sql/sql_table.cc b/sql/sql_table.cc
index f768659de0e..1c88bef7c5a 100644
--- a/sql/sql_table.cc
+++ b/sql/sql_table.cc
@@ -1515,7 +1515,7 @@ bool mysql_write_frm(ALTER_PARTITION_PARAM_TYPE *lpt, uint flags)
   /*
     Build shadow frm file name
   */
-  build_table_shadow_filename(shadow_path, sizeof(shadow_path), lpt);
+  build_table_shadow_filename(shadow_path, sizeof(shadow_path) - 1, lpt);
   strxmov(shadow_frm_name, shadow_path, reg_ext, NullS);
   if (flags & WFRM_WRITE_SHADOW)
   {
@@ -1590,7 +1590,7 @@ bool mysql_write_frm(ALTER_PARTITION_PARAM_TYPE *lpt, uint flags)
     /*
       Build frm file name
     */
-    build_table_filename(path, sizeof(path), lpt->db,
+    build_table_filename(path, sizeof(path) - 1, lpt->db,
                          lpt->table_name, "", 0);
     strxmov(frm_name, path, reg_ext, NullS);
     /*
@@ -1792,7 +1792,7 @@ int mysql_rm_table_part2(THD *thd, TABLE_LIST *tables, bool if_exists,
 			 bool dont_log_query)
 {
   TABLE_LIST *table;
-  char path[FN_REFLEN], *alias;
+  char path[FN_REFLEN + 1], *alias;
   uint path_length;
   String wrong_tables;
   int error= 0;
@@ -1922,7 +1922,8 @@ int mysql_rm_table_part2(THD *thd, TABLE_LIST *tables, bool if_exists,
       }
       alias= (lower_case_table_names == 2) ? table->alias : table->table_name;
       /* remove .frm file and engine files */
-      path_length= build_table_filename(path, sizeof(path), db, alias, reg_ext,
+      path_length= build_table_filename(path, sizeof(path) - 1, db, alias,
+                                        reg_ext,
                                         table->internal_tmp_table ?
                                         FN_IS_TMP : 0);
     }
@@ -2078,11 +2079,11 @@ err_with_placeholders:
 bool quick_rm_table(handlerton *base,const char *db,
                     const char *table_name, uint flags)
 {
-  char path[FN_REFLEN];
+  char path[FN_REFLEN + 1];
   bool error= 0;
   DBUG_ENTER("quick_rm_table");
 
-  uint path_length= build_table_filename(path, sizeof(path),
+  uint path_length= build_table_filename(path, sizeof(path) - 1,
                                          db, table_name, reg_ext, flags);
   if (my_delete(path,MYF(0)))
     error= 1; /* purecov: inspected */
@@ -3471,7 +3472,7 @@ bool mysql_create_table_no_lock(THD *thd,
                                 bool internal_tmp_table,
                                 uint select_field_count)
 {
-  char		path[FN_REFLEN];
+  char		path[FN_REFLEN + 1];
   uint          path_length;
   const char	*alias;
   uint		db_options, key_count;
@@ -3679,7 +3680,7 @@ bool mysql_create_table_no_lock(THD *thd,
   }
   else  
   {
-    path_length= build_table_filename(path, sizeof(path), db, alias, reg_ext,
+    path_length= build_table_filename(path, sizeof(path) - 1, db, alias, reg_ext,
                                       internal_tmp_table ? FN_IS_TMP : 0);
   }
 
@@ -3993,7 +3994,8 @@ mysql_rename_table(handlerton *base, const char *old_db,
                    const char *new_name, uint flags)
 {
   THD *thd= current_thd;
-  char from[FN_REFLEN], to[FN_REFLEN], lc_from[FN_REFLEN], lc_to[FN_REFLEN];
+  char from[FN_REFLEN + 1], to[FN_REFLEN + 1],
+    lc_from[FN_REFLEN + 1], lc_to[FN_REFLEN + 1];
   char *from_base= from, *to_base= to;
   char tmp_name[NAME_LEN+1];
   handler *file;
@@ -4005,9 +4007,9 @@ mysql_rename_table(handlerton *base, const char *old_db,
   file= (base == NULL ? 0 :
          get_new_handler((TABLE_SHARE*) 0, thd->mem_root, base));
 
-  build_table_filename(from, sizeof(from), old_db, old_name, "",
+  build_table_filename(from, sizeof(from) - 1, old_db, old_name, "",
                        flags & FN_FROM_IS_TMP);
-  build_table_filename(to, sizeof(to), new_db, new_name, "",
+  build_table_filename(to, sizeof(to) - 1, new_db, new_name, "",
                        flags & FN_TO_IS_TMP);
 
   /*
@@ -4020,13 +4022,13 @@ mysql_rename_table(handlerton *base, const char *old_db,
   {
     strmov(tmp_name, old_name);
     my_casedn_str(files_charset_info, tmp_name);
-    build_table_filename(lc_from, sizeof(lc_from), old_db, tmp_name, "",
+    build_table_filename(lc_from, sizeof(lc_from) - 1, old_db, tmp_name, "",
                          flags & FN_FROM_IS_TMP);
     from_base= lc_from;
 
     strmov(tmp_name, new_name);
     my_casedn_str(files_charset_info, tmp_name);
-    build_table_filename(lc_to, sizeof(lc_to), new_db, tmp_name, "",
+    build_table_filename(lc_to, sizeof(lc_to) - 1, new_db, tmp_name, "",
                          flags & FN_TO_IS_TMP);
     to_base= lc_to;
   }
@@ -4157,16 +4159,16 @@ static int prepare_for_restore(THD* thd, TABLE_LIST* table,
   else
   {
     char* backup_dir= thd->lex->backup_dir;
-    char src_path[FN_REFLEN], dst_path[FN_REFLEN], uname[FN_REFLEN];
+    char src_path[FN_REFLEN], dst_path[FN_REFLEN + 1], uname[FN_REFLEN];
     char* table_name= table->table_name;
     char* db= table->db;
 
-    VOID(tablename_to_filename(table->table_name, uname, sizeof(uname)));
+    VOID(tablename_to_filename(table->table_name, uname, sizeof(uname) - 1));
 
     if (fn_format_relative_to_data_home(src_path, uname, backup_dir, reg_ext))
       DBUG_RETURN(-1); // protect buffer overflow
 
-    build_table_filename(dst_path, sizeof(dst_path),
+    build_table_filename(dst_path, sizeof(dst_path) - 1,
                          db, table_name, reg_ext, 0);
 
     if (lock_and_wait_for_table_name(thd,table))
@@ -5088,7 +5090,7 @@ bool mysql_create_like_table(THD* thd, TABLE_LIST* table, TABLE_LIST* src_table,
                              HA_CREATE_INFO *create_info)
 {
   TABLE *name_lock= 0;
-  char src_path[FN_REFLEN], dst_path[FN_REFLEN];
+  char src_path[FN_REFLEN], dst_path[FN_REFLEN + 1];
   uint dst_path_length;
   char *db= table->db;
   char *table_name= table->table_name;
@@ -5098,7 +5100,7 @@ bool mysql_create_like_table(THD* thd, TABLE_LIST* table, TABLE_LIST* src_table,
 #ifdef WITH_PARTITION_STORAGE_ENGINE
   char tmp_path[FN_REFLEN];
 #endif
-  char ts_name[FN_LEN];
+  char ts_name[FN_LEN + 1];
   DBUG_ENTER("mysql_create_like_table");
 
 
@@ -5147,7 +5149,7 @@ bool mysql_create_like_table(THD* thd, TABLE_LIST* table, TABLE_LIST* src_table,
       goto err;
     if (!name_lock)
       goto table_exists;
-    dst_path_length= build_table_filename(dst_path, sizeof(dst_path),
+    dst_path_length= build_table_filename(dst_path, sizeof(dst_path) - 1,
                                           db, table_name, reg_ext, 0);
     if (!access(dst_path, F_OK))
       goto table_exists;
@@ -5888,7 +5890,7 @@ mysql_prepare_alter_table(THD *thd, TABLE *table,
 
   if (!create_info->tablespace && create_info->storage_media != HA_SM_MEMORY)
   {
-    char *tablespace= static_cast<char *>(thd->alloc(FN_LEN));
+    char *tablespace= static_cast<char *>(thd->alloc(FN_LEN + 1));
     /*
        Regular alter table of disk stored table (no tablespace/storage change)
        Copy tablespace name
@@ -6255,10 +6257,10 @@ bool mysql_alter_table(THD *thd,char *new_db, char *new_name,
 {
   TABLE *table, *new_table= 0, *name_lock= 0;
   int error= 0;
-  char tmp_name[80],old_name[32],new_name_buff[FN_REFLEN];
+  char tmp_name[80],old_name[32],new_name_buff[FN_REFLEN + 1];
   char new_alias_buff[FN_REFLEN], *table_name, *db, *new_alias, *alias;
   char index_file[FN_REFLEN], data_file[FN_REFLEN];
-  char path[FN_REFLEN];
+  char path[FN_REFLEN + 1];
   char reg_path[FN_REFLEN+1];
   ha_rows copied,deleted;
   handlerton *old_db_type, *new_db_type, *save_old_db_type;
@@ -6333,8 +6335,8 @@ bool mysql_alter_table(THD *thd,char *new_db, char *new_name,
   db=table_list->db;
   if (!new_db || !my_strcasecmp(table_alias_charset, new_db, db))
     new_db= db;
-  build_table_filename(reg_path, sizeof(reg_path), db, table_name, reg_ext, 0);
-  build_table_filename(path, sizeof(path), db, table_name, "", 0);
+  build_table_filename(reg_path, sizeof(reg_path) - 1, db, table_name, reg_ext, 0);
+  build_table_filename(path, sizeof(path) - 1, db, table_name, "", 0);
 
   mysql_ha_rm_tables(thd, table_list, FALSE);
 
@@ -6481,7 +6483,7 @@ view_err:
 	  DBUG_RETURN(TRUE);
         }
 
-        build_table_filename(new_name_buff, sizeof(new_name_buff),
+        build_table_filename(new_name_buff, sizeof(new_name_buff) - 1,
                              new_db, new_name_buff, reg_ext, 0);
         if (!access(new_name_buff, F_OK))
 	{
@@ -6982,9 +6984,9 @@ view_err:
     }
     else
     {
-      char path[FN_REFLEN];
+      char path[FN_REFLEN + 1];
       /* table is a normal table: Create temporary table in same directory */
-      build_table_filename(path, sizeof(path), new_db, tmp_name, "",
+      build_table_filename(path, sizeof(path) - 1, new_db, tmp_name, "",
                            FN_IS_TMP);
       /* Open our intermediate table */
       new_table=open_temporary_table(thd, path, new_db, tmp_name,0);
@@ -7312,7 +7314,7 @@ view_err:
     */
     char path[FN_REFLEN];
     TABLE *t_table;
-    build_table_filename(path, sizeof(path), new_db, table_name, "", 0);
+    build_table_filename(path + 1, sizeof(path) - 1, new_db, table_name, "", 0);
     t_table= open_temporary_table(thd, path, new_db, tmp_name, 0);
     if (t_table)
     {
diff --git a/sql/sql_view.cc b/sql/sql_view.cc
index c81a3ca9aba..2a4c5c950fe 100644
--- a/sql/sql_view.cc
+++ b/sql/sql_view.cc
@@ -801,7 +801,7 @@ static int mysql_register_view(THD *thd, TABLE_LIST *view,
 
   char md5[MD5_BUFF_LENGTH];
   bool can_be_merged;
-  char dir_buff[FN_REFLEN], path_buff[FN_REFLEN];
+  char dir_buff[FN_REFLEN + 1], path_buff[FN_REFLEN + 1];
   LEX_STRING dir, file, path;
   int error= 0;
   DBUG_ENTER("mysql_register_view");
@@ -878,11 +878,11 @@ static int mysql_register_view(THD *thd, TABLE_LIST *view,
   }
 loop_out:
   /* print file name */
-  dir.length= build_table_filename(dir_buff, sizeof(dir_buff),
+  dir.length= build_table_filename(dir_buff, sizeof(dir_buff) - 1,
                                    view->db, "", "", 0);
   dir.str= dir_buff;
 
-  path.length= build_table_filename(path_buff, sizeof(path_buff),
+  path.length= build_table_filename(path_buff, sizeof(path_buff) - 1,
                                     view->db, view->table_name, reg_ext, 0);
   path.str= path_buff;
 
@@ -1569,7 +1569,7 @@ err:
 
 bool mysql_drop_view(THD *thd, TABLE_LIST *views, enum_drop_mode drop_mode)
 {
-  char path[FN_REFLEN];
+  char path[FN_REFLEN + 1];
   TABLE_LIST *view;
   String non_existant_views;
   char *wrong_object_db= NULL, *wrong_object_name= NULL;
@@ -1584,7 +1584,7 @@ bool mysql_drop_view(THD *thd, TABLE_LIST *views, enum_drop_mode drop_mode)
   {
     TABLE_SHARE *share;
     frm_type_enum type= FRMTYPE_ERROR;
-    build_table_filename(path, sizeof(path),
+    build_table_filename(path, sizeof(path) - 1,
                          view->db, view->table_name, reg_ext, 0);
 
     if (access(path, F_OK) || 
@@ -1929,7 +1929,7 @@ mysql_rename_view(THD *thd,
 {
   LEX_STRING pathstr;
   File_parser *parser;
-  char path_buff[FN_REFLEN];
+  char path_buff[FN_REFLEN + 1];
   bool error= TRUE;
   DBUG_ENTER("mysql_rename_view");
 
@@ -1942,7 +1942,7 @@ mysql_rename_view(THD *thd,
        is_equal(&view_type, parser->type()))
   {
     TABLE_LIST view_def;
-    char dir_buff[FN_REFLEN];
+    char dir_buff[FN_REFLEN + 1];
     LEX_STRING dir, file;
 
     /*