Bug #26281:

 Fixed boundry checks in the INSERT() function:
 were one off.

1 files changed, 5 insertions, 5 deletions

diff --git a/sql/item_strfunc.cc b/sql/item_strfunc.cc
index 385f4ad9770..8a2574bd248 100644
--- a/sql/item_strfunc.cc
+++ b/sql/item_strfunc.cc
@@ -967,18 +967,18 @@ String *Item_func_insert::val_str(String *str)
       args[3]->null_value)
     goto null; /* purecov: inspected */
 
-  if ((start < 0) || (start > res->length() + 1))
+  if ((start < 0) || (start > res->length()))
     return res;                                 // Wrong param; skip insert
-  if ((length < 0) || (length > res->length() + 1))
-    length= res->length() + 1;
+  if ((length < 0) || (length > res->length()))
+    length= res->length();
 
   /* start and length are now sufficiently valid to pass to charpos function */
   start= res->charpos((int) start);
   length= res->charpos((int) length, (uint32) start);
 
   /* Re-testing with corrected params */
-  if (start > res->length() + 1)
-    return res;                                 // Wrong param; skip insert
+  if (start > res->length())
+    return res; /* purecov: inspected */        // Wrong param; skip insert
   if (length > res->length() - start)
     length= res->length() - start;