Bug#27898 UPDATEXML Crashes the Server!

Problem: when replacing the root element, UpdateXML
erroneously tried to mix old XML content with the
replacement string, which led to crash.
Fix: don't use the old XML content in these cases,
just return the replacement string.


mysql-test/r/xml.result:
  Adding test case
mysql-test/t/xml.test:
  Adding test case
sql/item_xmlfunc.cc:
  Adding special code to handle replacements of the root element -
  the replacing content is just copied to the result,
  the previous content of the XML value is removed.

1 files changed, 7 insertions, 0 deletions

diff --git a/mysql-test/t/xml.test b/mysql-test/t/xml.test
index 8517dce111f..88ea519e610 100644
--- a/mysql-test/t/xml.test
+++ b/mysql-test/t/xml.test
@@ -232,6 +232,13 @@ select UpdateXML(@xml, '/a/b/@bb2', '');
 select UpdateXML(@xml, '/a/b/@bb2', 'bb3="bb3"');
 
 #
+# Bug#27898 UPDATEXML Crashes the Server!
+#
+select updatexml('<div><div><span>1</span><span>2</span></div></div>',
+                 '/','<tr><td>1</td><td>2</td></tr>') as upd1;
+select updatexml('', '/', '') as upd2;
+
+#
 #  Bug#16234 XML: Crash if ExtractValue()
 #
 SET @xml= '<order><clerk>lesser wombat</clerk></order>';