Bug#52164 Assertion failed: param.sort_length, file .\filesort.cc, line 149

The crash happens because of incorrect max_length calculation
in QUOTE function(due to overflow). max_length is set
to 0 and it leads to assert failure.
The fix is to cast expression result to
ulonglong variable and adjust it if the
result exceeds MAX_BLOB_WIDTH.


mysql-test/r/func_str.result:
  test case
mysql-test/t/func_str.test:
  test case
sql/item_strfunc.h:
  cast expression result to ulonglong variable and
  adjust it if the result exceeds MAX_BLOB_WIDTH.

1 files changed, 2 insertions, 1 deletions

diff --git a/sql/item_strfunc.h b/sql/item_strfunc.h
index 5799c768162..aedc63164f2 100644
--- a/sql/item_strfunc.h
+++ b/sql/item_strfunc.h
@@ -694,8 +694,9 @@ public:
   String *val_str(String *);
   void fix_length_and_dec()
   {
+    ulonglong max_result_length= (ulonglong) args[0]->max_length * 2 + 2;
+    max_length= min(max_result_length, MAX_BLOB_WIDTH);
     collation.set(args[0]->collation);
-    max_length= args[0]->max_length * 2 + 2;
   }
 };