squash! 4cb69791aaa59e786859405c3c3826a6a15c4a09bb-11.0

- Ensure that TEMP_TABLE_PARAM.func_count includes all items that may
  need a copy function.
- Fixed that Aria allocates enough space for key copies.
- Fixed that Aria does not check empty_bits if not allocated.

The first issue could cause crashes, the other issues should not
affect anything.

1 files changed, 8 insertions, 7 deletions

diff --git a/sql/select_handler.cc b/sql/select_handler.cc
index 795ed8eb641..b0b8e58623d 100644
--- a/sql/select_handler.cc
+++ b/sql/select_handler.cc
@@ -51,18 +51,19 @@ select_handler::~select_handler()
 
 TABLE *select_handler::create_tmp_table(THD *thd, SELECT_LEX *select)
 {
-  DBUG_ENTER("select_handler::create_tmp_table");
   List<Item> types;
   TMP_TABLE_PARAM tmp_table_param;
+  TABLE *table;
+  DBUG_ENTER("select_handler::create_tmp_table");
+
   if (select->master_unit()->join_union_item_types(thd, types, 1))
     DBUG_RETURN(NULL);
   tmp_table_param.init();
-  tmp_table_param.field_count= types.elements;
-
-  TABLE *table= ::create_tmp_table(thd, &tmp_table_param, types,
-                                   (ORDER *) 0, false, 0,
-                                   TMP_TABLE_ALL_COLUMNS, 1,
-                                   &empty_clex_str, true, false);
+  tmp_table_param.field_count= tmp_table_param.func_count= types.elements;
+  table= ::create_tmp_table(thd, &tmp_table_param, types,
+                            (ORDER *) 0, false, 0,
+                            TMP_TABLE_ALL_COLUMNS, 1,
+                            &empty_clex_str, true, false);
   DBUG_RETURN(table);
 }