item_strfunc.cc:

  BUG #11104 
      Took out the offset-=delimiter_length-1 out of the for loop. It was causing
      basically this: 
      select substring_index('the king of the the hill', 'the', -2) to not work.
      The first iteration, offset would be initialised to 24, then strstr would 
      point at 'the king of the the* hill' ('*'means right before the 
      character following), returning a offset of 16. The for loop would then 
      decrement offset by two (3 - 1), to 14, now pointing at 
      "the king of th*e the hill", _skipping_ past the 'e' in the second to last
      'the', and therefore strstr would never have a chance of matching the 
      second to last 'the', then moving on to the 'the' at the begginning of the 
      string!
      In a nutshell, offset was being decremented by too great a value, preventing
      the second to last 'the' from being ever found, hence the result of 
      'king of the the hill' from the query that is reported in the bug report
func_str.test:
  BUG #11104
  Added tests to make sure fix addresses issues in original bug report
func_str.result:
  BUG #11104 
  New results for new tests


mysql-test/r/func_str.result:
  BUG #11104 
  
  New results for new tests
mysql-test/t/func_str.test:
  BUG #11104
  
  Added tests to make sure fix addresses issues in original bug report
sql/item_strfunc.cc:
  BUG #11104 
      Took out the offset-=delimiter_length-1 out of the for loop. It was causing
      basically this: 
      select substring_index('the king of the the hill', 'the', -2) to not work.
      The first iteration, offset would be initialised to 24, then strstr would 
      point at 'the king of the the* hill' ('*'means right before the 
      character following), returning a offset of 16. The for loop would then 
      decrement offset by two (3 - 1), to 14, now pointing at 
      "the king of th*e the hill", _skipping_ past the 'e' in the second to last
      'the', and therefore strstr would never have a chance of matching the 
      second to last 'the', then moving on to the 'the' at the begginning of the 
      string!
  
      In a nutshell, offset was being decremented by too great a value, preventing
      the second to last 'the' from being ever found, hence the result of 
      'king of the the hill' from the query that is reported in the bug report

1 files changed, 14 insertions, 2 deletions

diff --git a/sql/item_strfunc.cc b/sql/item_strfunc.cc
index d316c7eaf72..52a2dedb67c 100644
--- a/sql/item_strfunc.cc
+++ b/sql/item_strfunc.cc
@@ -42,7 +42,7 @@ static void my_coll_agg_error(DTCollation &c1, DTCollation &c2,
                               const char *fname)
 {
   my_error(ER_CANT_AGGREGATE_2COLLATIONS,MYF(0),
-  	   c1.collation->name,c1.derivation_name(),
+	   c1.collation->name,c1.derivation_name(),
 	   c2.collation->name,c2.derivation_name(),
 	   fname);
 }
@@ -1188,10 +1188,22 @@ String *Item_func_substr_index::val_str(String *str)
     }
     else
     {					// Start counting at end
-      for (offset=res->length() ; ; offset-=delimeter_length-1)
+      /*
+        Negative index, start counting at the end
+      */
+      for (offset=res->length(); offset ;)
       {
+        /* 
+          this call will result in finding the position pointing to one 
+          address space less than where the found substring is located
+          in res
+        */
 	if ((int) (offset=res->strrstr(*delimeter,offset)) < 0)
 	  return res;			// Didn't find, return org string
+        /*
+          At this point, we've searched for the substring
+          the number of times as supplied by the index value
+        */
 	if (!++count)
 	{
 	  offset+=delimeter_length;