Bug #29878 Garbage data generation when executing SESSION_USER() on a slave.

Item_func_user doesn't calculate anything in it's val_str() method,
just returns saved str_value.
Though Item::save_in_field method can destroy str_value, relying on
val_str() return. As a result we get the garbage stored in field.

We cannot use Item::save_in_field implementation for Item_func_user,
reimplement it in simpler way.

1 files changed, 38 insertions, 14 deletions

diff --git a/sql/item.cc b/sql/item.cc
index 2fc58eebe75..bd47fb706a6 100644
--- a/sql/item.cc
+++ b/sql/item.cc
@@ -336,6 +336,37 @@ int Item::save_date_in_field(Field *field)
 }
 
 
+/*
+  Store the string value in field directly
+
+  SYNOPSIS
+    Item::save_str_value_in_field()
+    field   a pointer to field where to store
+    result  the pointer to the string value to be stored
+
+  DESCRIPTION
+    The method is used by Item_*::save_in_field implementations
+    when we don't need to calculate the value to store
+    See Item_string::save_in_field() implementation for example
+
+  IMPLEMENTATION
+    Check if the Item is null and stores the NULL or the
+    result value in the field accordingly.
+
+  RETURN
+    Nonzero value if error
+*/
+
+int Item::save_str_value_in_field(Field *field, String *result)
+{
+  if (null_value)
+    return set_field_to_null(field);
+  field->set_notnull();
+  return field->store(result->ptr(), result->length(),
+		      collation.collation);
+}
+
+
 Item::Item():
   rsize(0), name(0), orig_name(0), name_length(0), fixed(0),
   is_autogenerated_name(TRUE),
@@ -3009,16 +3040,6 @@ my_decimal *Item_copy_string::val_decimal(my_decimal *decimal_value)
 }
 
 
-
-int Item_copy_string::save_in_field(Field *field, bool no_conversions)
-{
-  if (null_value)
-    return set_field_to_null(field);
-  field->set_notnull();
-  return field->store(str_value.ptr(),str_value.length(),
-		      collation.collation);
-}
-
 /*
   Functions to convert item to field (for send_fields)
 */
@@ -4417,6 +4438,12 @@ int Item_null::save_safe_in_field(Field *field)
 }
 
 
+/*
+  This implementation can lose str_value content, so if the
+  Item uses str_value to store something, it should
+  reimplement it's ::save_in_field() as Item_string, for example, does
+*/
+
 int Item::save_in_field(Field *field, bool no_conversions)
 {
   int error;
@@ -4474,10 +4501,7 @@ int Item_string::save_in_field(Field *field, bool no_conversions)
 {
   String *result;
   result=val_str(&str_value);
-  if (null_value)
-    return set_field_to_null(field);
-  field->set_notnull();
-  return field->store(result->ptr(),result->length(),collation.collation);
+  return save_str_value_in_field(field, result);
 }