Bug#11028 Crash on create table like

  Report error instead of crashing


mysql-test/r/create.result:
  Test for bug 11028
mysql-test/t/create.test:
  Test for bug 11028
sql/sql_table.cc:
  fix for null db name

3 files changed, 27 insertions, 5 deletions

diff --git a/mysql-test/r/create.result b/mysql-test/r/create.result
index de3840447dc..4c4b388388a 100644
--- a/mysql-test/r/create.result
+++ b/mysql-test/r/create.result
@@ -580,3 +580,9 @@ ERROR 42000: Incorrect database name 'xyz'
 create table t1(t1.name int);
 create table t2(test.t2.name int);
 drop table t1,t2;
+create database mysqltest;
+use mysqltest;
+drop database mysqltest;
+create table test.t1 like x;
+ERROR 42000: Incorrect database name 'NULL'
+drop table if exists test.t1;
diff --git a/mysql-test/t/create.test b/mysql-test/t/create.test
index b73cd28c71c..ca3446b46fc 100644
--- a/mysql-test/t/create.test
+++ b/mysql-test/t/create.test
@@ -492,3 +492,14 @@ create table t1(t1.name int);
 create table t2(test.t2.name int);
 drop table t1,t2;
 
+#
+# Bug#11028: Crash on create table like
+#
+create database mysqltest;
+use mysqltest;
+drop database mysqltest;
+--error 1102
+create table test.t1 like x;
+--disable_warnings
+drop table if exists test.t1;
+--enable_warnings
diff --git a/sql/sql_table.cc b/sql/sql_table.cc
index 3aa6da7ad0c..e2e6ee23323 100644
--- a/sql/sql_table.cc
+++ b/sql/sql_table.cc
@@ -2298,26 +2298,31 @@ int mysql_create_like_table(THD* thd, TABLE_LIST* table,
   char src_path[FN_REFLEN], dst_path[FN_REFLEN];
   char *db= table->db;
   char *table_name= table->real_name;
-  char *src_db= thd->db;
+  char *src_db;
   char *src_table= table_ident->table.str;
   int  err, res= -1;
   TABLE_LIST src_tables_list;
   DBUG_ENTER("mysql_create_like_table");
+  src_db= table_ident->db.str ? table_ident->db.str : thd->db;
 
   /*
     Validate the source table
   */
   if (table_ident->table.length > NAME_LEN ||
       (table_ident->table.length &&
-       check_table_name(src_table,table_ident->table.length)) ||
-      table_ident->db.str && check_db_name((src_db= table_ident->db.str)))
+       check_table_name(src_table,table_ident->table.length)))
   {
     my_error(ER_WRONG_TABLE_NAME, MYF(0), src_table);
     DBUG_RETURN(-1);
   }
+  if (!src_db || check_db_name(src_db))
+  {
+    my_error(ER_WRONG_DB_NAME, MYF(0), src_db ? src_db : "NULL");
+    DBUG_RETURN(-1);
+  }
 
-  src_tables_list.db= table_ident->db.str ? table_ident->db.str : thd->db;
-  src_tables_list.real_name= table_ident->table.str;
+  src_tables_list.db= src_db;
+  src_tables_list.real_name= src_table;
   src_tables_list.next= 0;
 
   if (lock_and_wait_for_table_name(thd, &src_tables_list))