Bug#18935421 RPAD DIES WITH CERTAIN PADSTR INTPUTS....

For rpad() and lpad(): verify that the padding string is well-formed.

sql/item.cc

 /*
-   Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.
+   Copyright (c) 2000, 2014, Oracle and/or its affiliates. All rights reserved.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -5143,6 +5143,18 @@ enum_field_types Item::field_type() const
 }
 
 
+/**
+  Verifies that the input string is well-formed according to its character set.
+  @param send_error   If true, call my_error if string is not well-formed.
+
+  Will truncate input string if it is not well-formed.
+
+  @return
+  If well-formed: input string.
+  If not well-formed:
+    if strict mode: NULL pointer and we set this Item's value to NULL
+    if not strict mode: input string truncated up to last good character
+ */
 String *Item::check_well_formed_result(String *str, bool send_error)
 {
   /* Check whether we got a well-formed string */

sql/item_strfunc.cc

@@ -2814,6 +2814,16 @@ String *Item_func_rpad::val_str(String *str)
     rpad->set_charset(&my_charset_bin);
   }
 
+#ifdef USE_MB
+  if (use_mb(rpad->charset()))
+  {
+    // This will chop off any trailing illegal characters from rpad.
+    String *well_formed_pad= args[2]->check_well_formed_result(rpad, false);
+    if (!well_formed_pad)
+      goto err;
+  }
+#endif
+
   if (count <= (res_char_length= res->numchars()))
   {						// String to pad is big enough
     res->length(res->charpos((int) count));	// Shorten result if longer
@@ -2917,6 +2927,16 @@ String *Item_func_lpad::val_str(String *str)
     pad->set_charset(&my_charset_bin);
   }
 
+#ifdef USE_MB
+  if (use_mb(pad->charset()))
+  {
+    // This will chop off any trailing illegal characters from pad.
+    String *well_formed_pad= args[2]->check_well_formed_result(pad, false);
+    if (!well_formed_pad)
+      goto err;
+  }
+#endif
+
   res_char_length= res->numchars();
 
   if (count <= res_char_length)