Bug#55648: Server crash on MIX/MAX on maximum time value

A typo in the Item_cache_datetime::val_str caused an assertion to fail on the
maximum time value.

mysql-test/r/func_group.result

@@ -1714,3 +1714,14 @@ NULL	NULL	NULL	NULL	NULL
 drop table t1;
 #
 End of 5.1 tests
+#
+# Bug#55648: Server crash on MIX/MAX on maximum time value
+#
+CREATE TABLE t1(c1 TIME NOT NULL);
+INSERT INTO t1 VALUES('837:59:59');
+INSERT INTO t1 VALUES('838:59:59');
+SELECT MAX(c1) FROM t1;
+MAX(c1)
+838:59:59
+DROP TABLE t1;
+# End of the bug#55648

mysql-test/t/func_group.test

@@ -1085,3 +1085,13 @@ drop table t1;
 --echo #
 --echo End of 5.1 tests
 
+--echo #
+--echo # Bug#55648: Server crash on MIX/MAX on maximum time value
+--echo #
+CREATE TABLE t1(c1 TIME NOT NULL);
+INSERT INTO t1 VALUES('837:59:59');
+INSERT INTO t1 VALUES('838:59:59');
+SELECT MAX(c1) FROM t1;
+DROP TABLE t1;
+--echo # End of the bug#55648
+

sql/item.cc

@@ -7510,13 +7510,13 @@ String *Item_cache_datetime::val_str(String *str)
       if (cached_field_type == MYSQL_TYPE_TIME)
       {
         ulonglong time= int_value;
-        DBUG_ASSERT(time < TIME_MAX_VALUE);
+        DBUG_ASSERT(time <= TIME_MAX_VALUE);
         set_zero_time(&ltime, MYSQL_TIMESTAMP_TIME);
         ltime.second= time % 100;
         time/= 100;
         ltime.minute= time % 100;
         time/= 100;
-        ltime.hour= time % 100;
+        ltime.hour= time;
       }
       else
       {