Fixed bug #27545.

Both arguments of the function NAME_CONST must be constant expressions.
This constraint is checked in the Item_name_const::fix_fields method. 
Yet if the argument of the function was not a constant expression no
error message was reported. As a result the client hanged waiting for a
response.
Now the function Item_name_const::fix_fields reports an error message
when any of the additional context conditions imposed on the function
NAME_CONST is not satisfied. 

3 files changed, 25 insertions, 7 deletions

diff --git a/mysql-test/r/func_misc.result b/mysql-test/r/func_misc.result
index c941790c35b..d04c22c0c9d 100644
--- a/mysql-test/r/func_misc.result
+++ b/mysql-test/r/func_misc.result
@@ -207,4 +207,9 @@ test
 SELECT NAME_CONST('test', 'test');
 test
 test
+CREATE TABLE t1 (a int);
+INSERT INTO t1 VALUES (5), (2);
+SELECT NAME_CONST(x,2) FROM (SELECT a x FROM t1) t;
+ERROR HY000: The 'NAME_CONST' syntax is reserved for purposes internal to the MySQL server
+DROP TABLE t1;
 End of 5.0 tests
diff --git a/mysql-test/t/func_misc.test b/mysql-test/t/func_misc.test
index 2c34f77b1ff..e8ee76b3a96 100644
--- a/mysql-test/t/func_misc.test
+++ b/mysql-test/t/func_misc.test
@@ -204,5 +204,18 @@ SELECT NAME_CONST('test', 1.0);
 SELECT NAME_CONST('test', -1.0);
 SELECT NAME_CONST('test', 'test');
 
+#
+# Bug #27545: erroneous usage of NAME_CONST with a name as the first parameter 
+#             resolved against a column name of a derived table hangs the client
+#
+
+CREATE TABLE t1 (a int);
+INSERT INTO t1 VALUES (5), (2);
+
+--error ER_RESERVED_SYNTAX
+SELECT NAME_CONST(x,2) FROM (SELECT a x FROM t1) t;
+
+DROP TABLE t1;
+
 --echo End of 5.0 tests
 
diff --git a/sql/item.cc b/sql/item.cc
index 3555df40060..4eeb2b2aa84 100644
--- a/sql/item.cc
+++ b/sql/item.cc
@@ -1221,14 +1221,14 @@ bool Item_name_const::fix_fields(THD *thd, Item **ref)
   s.length(0);
 
   if (value_item->fix_fields(thd, &value_item) ||
-      name_item->fix_fields(thd, &name_item))
-    return TRUE;
-  if (!(value_item->const_item() && name_item->const_item()))
+      name_item->fix_fields(thd, &name_item) ||
+      !value_item->const_item() ||
+      !name_item->const_item() ||
+      !(item_name= name_item->val_str(&s))) // Can't have a NULL name 
+  {
+    my_error(ER_RESERVED_SYNTAX, MYF(0), "NAME_CONST");
     return TRUE;
-
-  if (!(item_name= name_item->val_str(&s)))
-    return TRUE; /* Can't have a NULL name */
-
+  }
   set_name(item_name->ptr(), (uint) item_name->length(), system_charset_info);
   max_length= value_item->max_length;
   decimals= value_item->decimals;