3 files changed, 20 insertions, 1 deletions
diff --git a/sql/item.cc b/sql/item.cc
index 3407d2fecd4..2175a579f4a 100644
--- a/sql/item.cc
+++ b/sql/item.cc
@@ -5366,13 +5366,25 @@ inline uint char_val(char X)
 		 X-'a'+10);
 }
 
+Item_hex_string::Item_hex_string()
+{
+  hex_string_init("", 0);
+}
 
 Item_hex_string::Item_hex_string(const char *str, uint str_length)
 {
+  hex_string_init(str, str_length);
+}
+
+void Item_hex_string::hex_string_init(const char *str, uint str_length)
+{
   max_length=(str_length+1)/2;
   char *ptr=(char*) sql_alloc(max_length+1);
   if (!ptr)
+  {
+    str_value.set("", 0, &my_charset_bin);
     return;
+  }
   str_value.set(ptr,max_length,&my_charset_bin);
   char *end=ptr+max_length;
   if (max_length*2 != str_length)
diff --git a/sql/item.h b/sql/item.h
index d2303853743..174995b43e6 100644
--- a/sql/item.h
+++ b/sql/item.h
@@ -2123,7 +2123,7 @@ public:
 class Item_hex_string: public Item_basic_constant
 {
 public:
-  Item_hex_string() {}
+  Item_hex_string();
   Item_hex_string(const char *str,uint str_length);
   enum Type type() const { return VARBIN_ITEM; }
   double val_real()
@@ -2143,6 +2143,8 @@ public:
   bool eq(const Item *item, bool binary_cmp) const;
   virtual Item *safe_charset_converter(CHARSET_INFO *tocs);
   bool check_partition_func_processor(uchar *int_arg) {return FALSE;}
+private:
+  void hex_string_init(const char *str, uint str_length);
 };
 
 
diff --git a/sql/mysqld.cc b/sql/mysqld.cc
index 24614737a59..3664f46995f 100644
--- a/sql/mysqld.cc
+++ b/sql/mysqld.cc
@@ -8796,6 +8796,9 @@ bool is_secure_file_path(char *path)
   if (!opt_secure_file_priv)
     return TRUE;
 
+  if (strlen(path) >= FN_REFLEN)
+    return FALSE;
+
   if (my_realpath(buff1, path, 0))
   {
     /*
@@ -8882,6 +8885,8 @@ static int fix_paths(void)
     }
     else
     {
+      if (strlen(opt_secure_file_priv) >= FN_REFLEN)
+        opt_secure_file_priv[FN_REFLEN-1]= '\0';
       if (my_realpath(buff, opt_secure_file_priv, 0))
       {
         sql_print_warning("Failed to normalize the argument for --secure-file-priv.");