Fix for bug#42014: Crash, name_const with collate

Problem: some queries using NAME_CONST(.. COLLATE ...)
lead to server crash due to failed type cast.

Fix: return the underlying item's type in case of
NAME_CONST(.. COLLATE ...) to avoid wrong casting.


mysql-test/r/func_misc.result:
  Fix for bug#42014: Crash, name_const with coll
    - test result.
mysql-test/t/func_misc.test:
  Fix for bug#42014: Crash, name_const with coll
    - test case.
sql/item.cc:
  Fix for bug#42014: Crash, name_const with coll
    - in case of NAME_CONST('name', 'value' COLLATE collation)
  Item_name_const::type() returns type of 'value' argument 
  to awoid wrong type casting of the Item_name_const items.

1 files changed, 19 insertions, 6 deletions

diff --git a/sql/item.cc b/sql/item.cc
index fc5ee3d4d6a..bc1ae683e93 100644
--- a/sql/item.cc
+++ b/sql/item.cc
@@ -1243,13 +1243,26 @@ Item::Type Item_name_const::type() const
     valid_args guarantees value_item->basic_const_item(); if type is
     FUNC_ITEM, then we have a fudged item_func_neg() on our hands
     and return the underlying type.
+    For Item_func_set_collation()
+    e.g. NAME_CONST('name', 'value' COLLATE collation) we return its
+    'value' argument type. 
   */
-  return valid_args ?
-             (((value_item->type() == FUNC_ITEM) &&
-               (((Item_func *) value_item)->functype() == Item_func::NEG_FUNC)) ?
-             ((Item_func *) value_item)->key_item()->type() :
-             value_item->type()) :
-           NULL_ITEM;
+  if (!valid_args)
+    return NULL_ITEM;
+  Item::Type value_type= value_item->type();
+  if (value_type == FUNC_ITEM)
+  {
+    /* 
+      The second argument of NAME_CONST('name', 'value') must be 
+      a simple constant item or a NEG_FUNC/COLLATE_FUNC.
+    */
+    DBUG_ASSERT(((Item_func *) value_item)->functype() == 
+                Item_func::NEG_FUNC ||
+                ((Item_func *) value_item)->functype() == 
+                Item_func::COLLATE_FUNC);
+    return ((Item_func *) value_item)->key_item()->type();            
+  }
+  return value_type;
 }