From 4ddcb4eb46c62cf459936554d43351db740ba14d Mon Sep 17 00:00:00 2001
From: Alexey Botchkov <holyfoot@askmonty.org>
Date: Mon, 6 Aug 2018 13:37:09 +0400
Subject: MDEV-16750 JSON_SET mishandles unicode every second pair of
 arguments.

The charset of temporary storage (Item_func_json_insert::tmp_js)
  was not properly set.
---
 mysql-test/r/func_json.result | 12 ++++++++++++
 mysql-test/t/func_json.test   |  8 ++++++++
 sql/item_jsonfunc.cc          |  6 +++---
 3 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/mysql-test/r/func_json.result b/mysql-test/r/func_json.result
index 2a2df00ff61..e8b2fac4fb8 100644
--- a/mysql-test/r/func_json.result
+++ b/mysql-test/r/func_json.result
@@ -778,3 +778,15 @@ select REPLACE(JSON_VALUE(json_col, '$.key1'), 'null', '') = _latin1 X'53EC' fro
 REPLACE(JSON_VALUE(json_col, '$.key1'), 'null', '') = _latin1 X'53EC'
 1
 drop table t1;
+#
+# MDEV-16750 JSON_SET mishandles unicode every second pair of arguments.
+#
+SELECT JSON_SET('{}', '$.a', _utf8 0xC3B6);
+JSON_SET('{}', '$.a', _utf8 0xC3B6)
+{"a": "ö"}
+SELECT JSON_SET('{}', '$.a', _utf8 0xC3B6, '$.b', _utf8 0xC3B6);
+JSON_SET('{}', '$.a', _utf8 0xC3B6, '$.b', _utf8 0xC3B6)
+{"a": "ö", "b": "ö"}
+SELECT JSON_SET('{}', '$.a', _utf8 X'C3B6', '$.x', 1, '$.b', _utf8 X'C3B6');
+JSON_SET('{}', '$.a', _utf8 X'C3B6', '$.x', 1, '$.b', _utf8 X'C3B6')
+{"a": "ö", "x": 1, "b": "ö"}
diff --git a/mysql-test/t/func_json.test b/mysql-test/t/func_json.test
index 41e520404b6..fd5e3d7d7ee 100644
--- a/mysql-test/t/func_json.test
+++ b/mysql-test/t/func_json.test
@@ -440,3 +440,11 @@ select JSON_VALUE(json_col, '$.key1')= _latin1 X'53EC' from t1;
 select REPLACE(JSON_VALUE(json_col, '$.key1'), 'null', '') = _latin1 X'53EC' from t1;
 drop table t1;
 
+--echo #
+--echo # MDEV-16750 JSON_SET mishandles unicode every second pair of arguments.
+--echo #
+
+SELECT JSON_SET('{}', '$.a', _utf8 0xC3B6);
+SELECT JSON_SET('{}', '$.a', _utf8 0xC3B6, '$.b', _utf8 0xC3B6);
+SELECT JSON_SET('{}', '$.a', _utf8 X'C3B6', '$.x', 1, '$.b', _utf8 X'C3B6');
+
diff --git a/sql/item_jsonfunc.cc b/sql/item_jsonfunc.cc
index e9d38b78843..4a837646451 100644
--- a/sql/item_jsonfunc.cc
+++ b/sql/item_jsonfunc.cc
@@ -2384,8 +2384,9 @@ String *Item_func_json_insert::val_str(String *str)
   if ((null_value= args[0]->null_value))
     return 0;
 
-  str->set_charset(js->charset());
-  json_string_set_cs(&key_name, js->charset());
+  str->set_charset(collation.collation);
+  tmp_js.set_charset(collation.collation);
+  json_string_set_cs(&key_name, collation.collation);
 
   for (n_arg=1, n_path=0; n_arg < arg_count; n_arg+=2, n_path++)
   {
@@ -2599,7 +2600,6 @@ continue_point:
   json_scan_start(&je, js->charset(),(const uchar *) js->ptr(),
                   (const uchar *) js->ptr() + js->length());
   str->length(0);
-  str->set_charset(js->charset());
   if (json_nice(&je, str, Item_func_json_format::LOOSE))
     goto js_error;
 
-- 
cgit v1.2.1