Bug#22138: Unhandled NULL caused server crash

The Cached_item_decimal::cmp() method wasn't checking for null pointer
returned from the val_decimal() of the item being cached.
This leads to server crash.

The Cached_item_decimal::cmp() method now check for null values.

1 files changed, 9 insertions, 3 deletions

diff --git a/sql/item_buff.cc b/sql/item_buff.cc
index 1661f04a4ae..37f9ca7ce6c 100644
--- a/sql/item_buff.cc
+++ b/sql/item_buff.cc
@@ -132,11 +132,17 @@ bool Cached_item_decimal::cmp()
 {
   my_decimal tmp;
   my_decimal *ptmp= item->val_decimal(&tmp);
-  if (null_value != item->null_value || my_decimal_cmp(&value, ptmp))
+  if (null_value != item->null_value ||
+      (!item->null_value && my_decimal_cmp(&value, ptmp)))
   {
     null_value= item->null_value;
-    my_decimal2decimal(ptmp, &value);
-    return TRUE;
+    /* Save only not null values */
+    if (!null_value)
+    {
+      my_decimal2decimal(ptmp, &value);
+      return TRUE;
+    }
+    return FALSE;
   }
   return FALSE;
 }