Fix for bug #31249: Assertion `!table || (!table->write_set ||

bitmap_is_set(table->write_set, fiel

Problem: creating a temporary table we allocate the group buffer if needed
followed by table bitmaps (see create_tmp_table()). Reserving less memory for 
the group buffer than actually needed (used) for values retrieval may lead 
to overlapping with followed bitmaps in the memory pool that in turn leads 
to unpredictable consequences.

As we use Item->max_length sometimes to calculate group buffer size,
it must be set to proper value. In this particular case 
Item_datetime_typecast::max_length is too small.

Another problem is that we use max_length to calculate the group buffer
key length for items represented as DATE/TIME fields which is superfluous.

Fix: set Item_datetime_typecast::max_length properly,
accurately calculate the group buffer key length for items 
represented as DATE/TIME fields in the buffer.


mysql-test/r/type_datetime.result:
  Fix for bug #31249: Assertion `!table || (!table->write_set || 
  bitmap_is_set(table->write_set, fiel
    - test result.
mysql-test/t/type_datetime.test:
  Fix for bug #31249: Assertion `!table || (!table->write_set || 
  bitmap_is_set(table->write_set, fiel
    - test case.
sql/item_timefunc.h:
  Fix for bug #31249: Assertion `!table || (!table->write_set || 
  bitmap_is_set(table->write_set, fiel
    - set Item_datetime_typecast::max_length properly.
sql/sql_select.cc:
  Fix for bug #31249: Assertion `!table || (!table->write_set || 
  bitmap_is_set(table->write_set, fiel
    - the group buffer key length for items represented as 
  DATE/TIME fields in the buffer should be calculated using
  the maximum pack length of such fields (== 8), using 
  max_length here is redundant.

1 files changed, 3 insertions, 1 deletions

diff --git a/sql/item_timefunc.h b/sql/item_timefunc.h
index 8e925a0156f..94bee28bb6b 100644
--- a/sql/item_timefunc.h
+++ b/sql/item_timefunc.h
@@ -844,7 +844,9 @@ public:
   enum_field_types field_type() const { return MYSQL_TYPE_DATETIME; }
   void fix_length_and_dec()
   {
-    Item_typecast_maybe_null::fix_length_and_dec();
+    collation.set(&my_charset_bin);
+    maybe_null= 1;
+    max_length= MAX_DATETIME_FULL_WIDTH * MY_CHARSET_BIN_MB_MAXLEN;
     decimals= DATETIME_DEC;
   }