MDEV-26732 Assertion `0' failed in Item::val_nativebb-10.5-bar-MDEV-26732

Also fixes MDEV-24619 Wrong result or Assertion `0' in Item::val_native / Type_handler_inet6::Item_val_native_with_conversion

Type_handler_inet6::create_item_copy() created a generic Item_copy_string,
which does not implement val_native() - it has a dummy implementation
with DBUG_ASSERT(0), which made the server crash.

Fix:

- Adding a new class Type_handler_inet6
  which implements val_native().
- Fixing Type_handler_inet6::create_item_copy()
  to make Item_copy_inet6 instead of Item_copy_string.

4 files changed, 119 insertions, 0 deletions

diff --git a/plugin/type_inet/mysql-test/type_inet/type_inet6.result b/plugin/type_inet/mysql-test/type_inet/type_inet6.result
index da949481337..ac16f5c06ce 100644
--- a/plugin/type_inet/mysql-test/type_inet/type_inet6.result
+++ b/plugin/type_inet/mysql-test/type_inet/type_inet6.result
@@ -2159,3 +2159,38 @@ IFNULL(c, '::1')
 ::1
 DROP TABLE t2;
 DROP TABLE t1;
+#
+# MDEV-26732 Assertion `0' failed in Item::val_native
+#
+SELECT CAST(CONCAT('::', REPEAT('',RAND())) AS INET6) AS f, var_pop('x') FROM dual HAVING f > '';
+f	var_pop('x')
+Warnings:
+Warning	1292	Truncated incorrect DOUBLE value: 'x'
+Warning	1292	Incorrect inet6 value: ''
+SELECT CAST(CONCAT('::', REPEAT('',RAND())) AS INET6) AS f, var_pop(1) FROM dual HAVING f >= '::';
+f	var_pop(1)
+::	0.0000
+CREATE TABLE t1(id INET6 NOT NULL PRIMARY KEY, dsc INET6);
+INSERT INTO t1 VALUES ('::1', '1::1'),('::3', '1::3'),('::4', NULL);
+CREATE TABLE t2 SELECT COALESCE(t1.dsc), COUNT(*) FROM t1 GROUP BY t1.id;
+SELECT * FROM t2 ORDER BY 1,2;
+COALESCE(t1.dsc)	COUNT(*)
+NULL	1
+1::1	1
+1::3	1
+DROP TABLE t1, t2;
+#
+# MDEV-24619 Wrong result or Assertion `0' in Item::val_native / Type_handler_inet6::Item_val_native_with_conversion
+#
+CREATE TABLE t1 (a INET6);
+INSERT INTO t1 VALUES ('::'),('::');
+SELECT IF(1, '::', a) AS f FROM t1 GROUP BY 'foo' HAVING f != '';
+f
+Warnings:
+Warning	1292	Incorrect inet6 value: ''
+SELECT IF(1, '::', a) AS f FROM t1 GROUP BY 'foo' HAVING f != '::';
+f
+SELECT IF(1, '::', a) AS f FROM t1 GROUP BY 'foo' HAVING f != '::1';
+f
+::
+DROP TABLE t1;
diff --git a/plugin/type_inet/mysql-test/type_inet/type_inet6.test b/plugin/type_inet/mysql-test/type_inet/type_inet6.test
index ad4cfe57986..6a5db1ad43f 100644
--- a/plugin/type_inet/mysql-test/type_inet/type_inet6.test
+++ b/plugin/type_inet/mysql-test/type_inet/type_inet6.test
@@ -1586,3 +1586,29 @@ SELECT * FROM t2;
 DROP TABLE t2;
 
 DROP TABLE t1;
+
+--echo #
+--echo # MDEV-26732 Assertion `0' failed in Item::val_native
+--echo #
+
+# This tests Item_copy_inet6::val_native()
+SELECT CAST(CONCAT('::', REPEAT('',RAND())) AS INET6) AS f, var_pop('x') FROM dual HAVING f > '';
+SELECT CAST(CONCAT('::', REPEAT('',RAND())) AS INET6) AS f, var_pop(1) FROM dual HAVING f >= '::';
+
+# This tests Item_copy_inet6::save_in_field()
+CREATE TABLE t1(id INET6 NOT NULL PRIMARY KEY, dsc INET6);
+INSERT INTO t1 VALUES ('::1', '1::1'),('::3', '1::3'),('::4', NULL);
+CREATE TABLE t2 SELECT COALESCE(t1.dsc), COUNT(*) FROM t1 GROUP BY t1.id;
+SELECT * FROM t2 ORDER BY 1,2;
+DROP TABLE t1, t2;
+
+--echo #
+--echo # MDEV-24619 Wrong result or Assertion `0' in Item::val_native / Type_handler_inet6::Item_val_native_with_conversion
+--echo #
+
+CREATE TABLE t1 (a INET6);
+INSERT INTO t1 VALUES ('::'),('::');
+SELECT IF(1, '::', a) AS f FROM t1 GROUP BY 'foo' HAVING f != '';
+SELECT IF(1, '::', a) AS f FROM t1 GROUP BY 'foo' HAVING f != '::';
+SELECT IF(1, '::', a) AS f FROM t1 GROUP BY 'foo' HAVING f != '::1';
+DROP TABLE t1;
diff --git a/plugin/type_inet/sql_type_inet.cc b/plugin/type_inet/sql_type_inet.cc
index 14d854be14f..9832a84a1b9 100644
--- a/plugin/type_inet/sql_type_inet.cc
+++ b/plugin/type_inet/sql_type_inet.cc
@@ -1227,6 +1227,57 @@ public:
 };
 
 
+class Item_copy_inet6: public Item_copy
+{
+  NativeBufferInet6 m_value;
+public:
+  Item_copy_inet6(THD *thd, Item *item_arg): Item_copy(thd, item_arg) {}
+
+  bool val_native(THD *thd, Native *to) override
+  {
+    if (null_value)
+      return true;
+    return to->copy(m_value.ptr(), m_value.length());
+  }
+  String *val_str(String *to) override
+  {
+    if (null_value)
+      return NULL;
+    Inet6_null tmp(m_value.ptr(), m_value.length());
+    return tmp.is_null() || tmp.to_string(to) ? NULL : to;
+  }
+  my_decimal *val_decimal(my_decimal *to) override
+  {
+    my_decimal_set_zero(to);
+    return to;
+  }
+  double val_real() override
+  {
+    return 0;
+  }
+  longlong val_int() override
+  {
+    return 0;
+  }
+  bool get_date(THD *thd, MYSQL_TIME *ltime, date_mode_t fuzzydate) override
+  {
+    set_zero_time(ltime, MYSQL_TIMESTAMP_TIME);
+    return null_value;
+  }
+  void copy() override
+  {
+    null_value= item->val_native(current_thd, &m_value);
+    DBUG_ASSERT(null_value == item->null_value);
+  }
+  int save_in_field(Field *field, bool no_conversions) override
+  {
+    return Item::save_in_field(field, no_conversions);
+  }
+  Item *get_copy(THD *thd) override
+  { return get_item_copy<Item_copy_inet6>(thd, this); }
+};
+
+
 class in_inet6 :public in_vector
 {
   Inet6 m_value;
@@ -1465,6 +1516,12 @@ Item_cache *Type_handler_inet6::Item_get_cache(THD *thd, const Item *item) const
 }
 
 
+Item_copy *Type_handler_inet6::create_item_copy(THD *thd, Item *item) const
+{
+  return new (thd->mem_root) Item_copy_inet6(thd, item);
+}
+
+
 Item *
 Type_handler_inet6::make_const_item_for_comparison(THD *thd,
                                                    Item *src,
diff --git a/plugin/type_inet/sql_type_inet.h b/plugin/type_inet/sql_type_inet.h
index 4de1124f4c1..c1abb11fc59 100644
--- a/plugin/type_inet/sql_type_inet.h
+++ b/plugin/type_inet/sql_type_inet.h
@@ -691,6 +691,7 @@ public:
   Item *create_typecast_item(THD *thd, Item *item,
                              const Type_cast_attributes &attr) const override;
 
+  Item_copy *create_item_copy(THD *thd, Item *item) const override;
   int cmp_native(const Native &a, const Native &b) const override
   {
     DBUG_ASSERT(a.length() == Inet6::binary_length());