Bug#37740 Server crashes on execute statement with full text search and

          match against.


Server crashes when executing prepared statement with duplicating
MATCH() function calls in SELECT and ORDER BY expressions, e.g.:
SELECT MATCH(a) AGAINST('test') FROM t1 ORDER BY MATCH(a) AGAINST('test')

This query gets optimized by the server, so the value returned
by MATCH() from the SELECT list is reused for ORDER BY purposes.
To make this optimization server is comparing items from
SELECT and ORDER BY lists. We were getting server crash because
comparision function for MATCH() item is not intended to be called
at this point of execution.

In 5.0 and 5.1 this problem is workarounded by resetting MATCH()
item to the state as it was during PREPARE.

In 6.0 correct comparision function will be implemented and
duplicating MATCH() items from the ORDER BY list will be
optimized.

mysql-test/r/fulltext.result:
  Updated with the test case for Bug#37740
mysql-test/t/fulltext.test:
  A test case for Bug#37740.
sql/item_func.h:
  True initialization of 'table' happens in ::fix_fields(). As
  Item_func_match::eq() may be called before ::fix_fields(), it is
  expected that 'table' is initialized to 0 when it is reused.
  
  This is mostly affecting prepared statements, when the same item
  doesn't get destroyed, but rather cleaned up and reused.

1 files changed, 1 insertions, 0 deletions

diff --git a/sql/item_func.h b/sql/item_func.h
index 33aeddfe6e6..47a13559e90 100644
--- a/sql/item_func.h
+++ b/sql/item_func.h
@@ -1456,6 +1456,7 @@ public:
       ft_handler->please->close_search(ft_handler);
     ft_handler= 0;
     concat_ws= 0;
+    table= 0;           // required by Item_func_match::eq()
     DBUG_VOID_RETURN;
   }
   enum Functype functype() const { return FT_FUNC; }