MDEV-5504 Server crashes in String::length on SELECT with MONTHNAME, GROUP BY, ROLLUP

The crash happened because Item_func_monthname was derived from
Item_func_month, so Item_func_monthname::is_null() did not work fine.
Backporting a change from 5.5: Item_func_monthname is now derived from
Item_str_func.

2 files changed, 7 insertions, 11 deletions

diff --git a/sql/item_timefunc.cc b/sql/item_timefunc.cc
index b618ec038f2..b5d43786248 100644
--- a/sql/item_timefunc.cc
+++ b/sql/item_timefunc.cc
@@ -883,16 +883,13 @@ String* Item_func_monthname::val_str(String* str)
 {
   DBUG_ASSERT(fixed == 1);
   const char *month_name;
-  uint month= (uint) val_int();
   uint err;
+  MYSQL_TIME ltime;
 
-  if (null_value || !month)
-  {
-    null_value=1;
-    return (String*) 0;
-  }
-  null_value=0;
-  month_name= locale->month_names->type_names[month-1];
+  if ((null_value= (get_arg0_date(&ltime, 0) || !ltime.month)))
+    return (String *) 0;
+
+  month_name= locale->month_names->type_names[ltime.month - 1];
   str->copy(month_name, (uint) strlen(month_name), &my_charset_utf8_bin,
 	    collation.collation, &err);
   return str;
diff --git a/sql/item_timefunc.h b/sql/item_timefunc.h
index d97a5fbc903..7d865df8fea 100644
--- a/sql/item_timefunc.h
+++ b/sql/item_timefunc.h
@@ -134,14 +134,13 @@ public:
 };
 
 
-class Item_func_monthname :public Item_func_month
+class Item_func_monthname :public Item_str_func
 {
   MY_LOCALE *locale;
 public:
-  Item_func_monthname(Item *a) :Item_func_month(a) {}
+  Item_func_monthname(Item *a) :Item_str_func(a) {}
   const char *func_name() const { return "monthname"; }
   String *val_str(String *str);
-  enum Item_result result_type () const { return STRING_RESULT; }
   void fix_length_and_dec();
   bool check_partition_func_processor(uchar *int_arg) {return TRUE;}
   bool check_vcol_func_processor(uchar *int_arg) {return FALSE;}