Fix for bug #10891 (string->decimal conversion crashes server)

mysql-test/r/type_newdecimal.result:
  test result fixed
mysql-test/t/type_newdecimal.test:
  test case added
strings/decimal.c:
  new_point can be 0, and this case should be handled separately

1 files changed, 14 insertions, 5 deletions

diff --git a/strings/decimal.c b/strings/decimal.c
index be403c5e3fb..76e62080ba0 100644
--- a/strings/decimal.c
+++ b/strings/decimal.c
@@ -739,11 +739,20 @@ int decimal_shift(decimal_t *dec, int shift)
   beg= ROUND_UP(beg + 1) - 1;
   end= ROUND_UP(end) - 1;
   DBUG_ASSERT(new_point >= 0);
-  new_point= ROUND_UP(new_point) - 1;
-  for(; new_point > end; new_point--)
-    dec->buf[new_point]= 0;
-  for(; new_point < beg; new_point++)
-    dec->buf[new_point]= 0;
+  
+  /* We don't want negative new_point below */
+  if (new_point != 0)
+    new_point= ROUND_UP(new_point) - 1;
+
+  if (new_point > end)
+    do
+    {
+      dec->buf[new_point]=0;
+    }while (--new_point > end);
+  else
+    for (; new_point < beg; new_point++)
+      dec->buf[new_point]= 0;
+
   dec->intg= digits_int;
   dec->frac= digits_frac;
   return err;