Fixed bug#13575: SP funcs in select with distinct/group and order by can

produce wrong data

By default Item_sp_func::val_str() returns string from it's result_field 
internal buffer. When grouping is present Item_copy_string is used to 
store SP function result, but it doesn't additionally buffer the result.
When the next record is read, internal buffer is overwritten, due to
this Item_copy_string::val_str() will have wrong data. Thus producing
weird query result.

The Item_func_sp::val_str() now makes a copy of returned value to prevent
occasional corruption.


mysql-test/t/sp.test:
  Added test case for bug#13575: SP funcs in select with distinct/group and order by can
  produce wrong data
mysql-test/r/sp.result:
  Added test case for bug#13575: SP funcs in select with distinct/group and
      order by can produce wrong data
sql/item_func.h:
  Fixed bug#13575: SP funcs in select with distinct/group and order by can
      produce wrong data
      The Item_func_sp::val_str() now makes a copy of returned value to prevent
      occasinal corruption.

1 files changed, 13 insertions, 1 deletions

diff --git a/sql/item_func.h b/sql/item_func.h
index d8fa45fb9c0..ccbbbab1df4 100644
--- a/sql/item_func.h
+++ b/sql/item_func.h
@@ -1421,9 +1421,21 @@ public:
 
   String *val_str(String *str)
   {
+    String buf;
+    char buff[20];
+    buf.set(buff, 20, str->charset());
+    buf.length(0);
     if (execute(&result_field))
       return NULL;
-    return result_field->val_str(str);
+    /*
+      result_field will set buf pointing to internal buffer
+      of the resul_field. Due to this it will change any time
+      when SP is executed. In order to prevent occasional
+      corruption of returned value, we make here a copy.
+    */
+    result_field->val_str(&buf);
+    str->copy(buf);
+    return str;
   }
 
   virtual bool change_context_processor(byte *cntx)