6 files changed, 67 insertions, 2 deletions
diff --git a/mysql-test/r/grant3.result b/mysql-test/r/grant3.result
index cc7f46855b2..f38848111ad 100644
--- a/mysql-test/r/grant3.result
+++ b/mysql-test/r/grant3.result
@@ -138,3 +138,20 @@ SELECT user, host, db, select_priv FROM mysql.db where user = 'CUser2' order by
 user	host	db	select_priv
 DROP USER CUser2@localhost;
 DROP USER CUser2@LOCALHOST;
+CREATE DATABASE mysqltest_1;
+CREATE TABLE mysqltest_1.t1 (a INT);
+CREATE USER 'mysqltest1'@'%';
+GRANT SELECT, UPDATE ON `mysqltest_1`.* TO 'mysqltest1'@'%';
+REVOKE SELECT ON `mysqltest_1`.* FROM 'mysqltest1'@'%';
+GRANT SELECT, UPDATE ON `mysqltest\_1`.* TO 'mysqltest1'@'%';
+FLUSH PRIVILEGES;
+SHOW GRANTS;
+Grants for mysqltest1@%
+GRANT USAGE ON *.* TO 'mysqltest1'@'%'
+GRANT SELECT, UPDATE ON `mysqltest\_1`.* TO 'mysqltest1'@'%'
+GRANT UPDATE ON `mysqltest_1`.* TO 'mysqltest1'@'%'
+SELECT * FROM mysqltest_1.t1;
+a
+DROP USER 'mysqltest1'@'%';
+DROP DATABASE mysqltest_1;
+End of 5.0 tests
diff --git a/mysql-test/r/select.result b/mysql-test/r/select.result
index 2f305f6ec5d..e56c1629a64 100644
--- a/mysql-test/r/select.result
+++ b/mysql-test/r/select.result
@@ -4313,6 +4313,12 @@ SELECT * FROM t1 WHERE c1 > NULL + 1;
 c1
 DROP TABLE t1;
 
+CREATE TABLE t1 (a VARCHAR(10) NOT NULL PRIMARY KEY);
+INSERT INTO t1 (a) VALUES ('foo0'), ('bar0'), ('baz0');
+SELECT * FROM t1 WHERE a IN (CONCAT('foo', 0), 'bar');
+a
+foo0
+DROP TABLE t1;
 End of 5.0 tests
 create table t1(a INT, KEY (a));
 INSERT INTO t1 VALUES (1),(2),(3),(4),(5);
diff --git a/mysql-test/t/grant3.test b/mysql-test/t/grant3.test
index fac577ef0ff..8eceb851c29 100644
--- a/mysql-test/t/grant3.test
+++ b/mysql-test/t/grant3.test
@@ -134,3 +134,29 @@ SELECT user, host, db, select_priv FROM mysql.db where user = 'CUser2' order by
 
 DROP USER CUser2@localhost;
 DROP USER CUser2@LOCALHOST;
+
+
+#
+# Bug#31194: Privilege ordering does not order properly for wildcard values
+#
+
+CREATE DATABASE mysqltest_1;
+CREATE TABLE mysqltest_1.t1 (a INT);
+CREATE USER 'mysqltest1'@'%';
+GRANT SELECT, UPDATE ON `mysqltest_1`.* TO 'mysqltest1'@'%';
+REVOKE SELECT ON `mysqltest_1`.* FROM 'mysqltest1'@'%';
+GRANT SELECT, UPDATE ON `mysqltest\_1`.* TO 'mysqltest1'@'%';
+FLUSH PRIVILEGES;
+
+connect (conn1,localhost,mysqltest1,,);
+connection conn1;
+SHOW GRANTS;
+SELECT * FROM mysqltest_1.t1;
+disconnect conn1;
+
+connection default;
+DROP USER 'mysqltest1'@'%';
+DROP DATABASE mysqltest_1;
+
+
+--echo End of 5.0 tests
diff --git a/mysql-test/t/select.test b/mysql-test/t/select.test
index bc0e4ae307f..b680c3642a6 100644
--- a/mysql-test/t/select.test
+++ b/mysql-test/t/select.test
@@ -3661,6 +3661,17 @@ DROP TABLE t1;
 
 --echo
 
+###########################################################################
+
+#
+# Bug #33764: Wrong result with IN(), CONCAT() and implicit type conversion
+#
+
+CREATE TABLE t1 (a VARCHAR(10) NOT NULL PRIMARY KEY);
+INSERT INTO t1 (a) VALUES ('foo0'), ('bar0'), ('baz0');
+SELECT * FROM t1 WHERE a IN (CONCAT('foo', 0), 'bar');
+DROP TABLE t1;
+
 --echo End of 5.0 tests
 
 #
diff --git a/sql/item_cmpfunc.cc b/sql/item_cmpfunc.cc
index 1d1e28593d4..01eca1b20a8 100644
--- a/sql/item_cmpfunc.cc
+++ b/sql/item_cmpfunc.cc
@@ -3053,7 +3053,10 @@ void in_string::set(uint pos,Item *item)
   {
     if (res->uses_buffer_owned_by(str))
       res->copy();
-    *str= *res;
+    if (item->type() == Item::FUNC_ITEM)
+      str->copy(*res);
+    else
+      *str= *res;
   }
   if (!str->charset())
   {
diff --git a/sql/sql_acl.cc b/sql/sql_acl.cc
index d2d26da229a..064aa6dc044 100644
--- a/sql/sql_acl.cc
+++ b/sql/sql_acl.cc
@@ -801,7 +801,9 @@ static ulong get_sort(uint count,...)
     {
       for (; *str ; str++)
       {
-	if (*str == wild_many || *str == wild_one || *str == wild_prefix)
+        if (*str == wild_prefix && str[1])
+          str++;
+        else if (*str == wild_many || *str == wild_one)
         {
           wild_pos= (uint) (str - start) + 1;
           break;