MDEV-11780 Crash with PREPARE + SP out parameter + literal

Before "MDEV-10709 Expressions as parameters to Dynamic SQL" only
user variables were syntactically allowed as EXECUTE parameters.
User variables were OK as both IN and OUT parameters.
When Item_param was bound to an actual parameter (a user variable),
it automatically meant that the bound Item was settable.
The DBUG_ASSERT() in Protocol_text::send_out_parameters() guarded that
the actual parameter is really settable.

After MDEV-10709, any kind of expressions are allowed as EXECUTE IN parameters.
But the patch for MDEV-10709 forgot to check that only descendants of
Settable_routine_parameter should be allowed as OUT parameters.
So an attempt to pass a non-settable parameter as an OUT parameter
made server crash on the above mentioned DBUG_ASSERT.

This patch changes Item_param::get_settable_routine_parameter(),
which previously always returned "this". Now, when Item_param is bound
to some Item, it caches if the bound Item is settable.
Item_param::get_settable_routine_parameter() now returns "this" only
if the bound actual parameter is settable, and returns NULL otherwise.

1 files changed, 29 insertions, 0 deletions

diff --git a/mysql-test/t/ps.test b/mysql-test/t/ps.test
index 00e0c4086bb..74ab7659ac6 100644
--- a/mysql-test/t/ps.test
+++ b/mysql-test/t/ps.test
@@ -4287,3 +4287,32 @@ INSERT INTO t1 VALUES (1),(2),(3);
 --error ER_INVALID_DEFAULT_PARAM
 EXECUTE IMMEDIATE 'EXPLAIN EXTENDED SELECT * FROM t1 WHERE ?+a<=>?+a' USING DEFAULT,DEFAULT;
 DROP TABLE t1;
+
+--echo #
+--echo # MDEV-11780 Crash with PREPARE + SP out parameter + literal
+--echo #
+
+DELIMITER $$;
+CREATE OR REPLACE PROCEDURE p1(OUT a INT)
+BEGIN
+  SET a=10;
+END;
+$$
+DELIMITER ;$$
+
+PREPARE stmt FROM 'CALL p1(?)';
+--error ER_SP_NOT_VAR_ARG
+EXECUTE stmt USING 10;
+--error ER_SP_NOT_VAR_ARG
+EXECUTE stmt USING DEFAULT;
+--error ER_SP_NOT_VAR_ARG
+EXECUTE stmt USING IGNORE;
+DEALLOCATE PREPARE stmt;
+
+--error ER_SP_NOT_VAR_ARG
+EXECUTE IMMEDIATE 'CALL p1(?)' USING 10;
+--error ER_SP_NOT_VAR_ARG
+EXECUTE IMMEDIATE 'CALL p1(?)' USING DEFAULT;
+--error ER_SP_NOT_VAR_ARG
+EXECUTE IMMEDIATE 'CALL p1(?)' USING IGNORE;
+DROP PROCEDURE p1;