Fix for Bug #13124 Stored Procedure using SELECT INTO crashes server

mysql-test/r/sp.result:
  added a test
mysql-test/t/sp.test:
  corrected result file
sql/item.cc:
  check for NULL value before copying string

mysql-test/r/sp.result

@@ -3225,4 +3225,12 @@ select @var|
 @var
 abcdabcd
 drop procedure bug12849_2|
+drop procedure if exists bug13124|
+create procedure bug13124()
+begin
+declare y integer;
+set @x=y;
+end|
+call bug13124()|
+drop procedure  bug13124|
 drop table t1,t2;

mysql-test/t/sp.test

@@ -4063,6 +4063,21 @@ call bug12849_2(@var)|
 select @var|
 drop procedure bug12849_2|
 
+#
+# Bug #13124    Stored Procedure using SELECT INTO crashes server
+#
+
+--disable_warnings
+drop procedure if exists bug13124|
+--enable_warnings
+create procedure bug13124()
+begin
+  declare y integer;
+  set @x=y;
+end|
+call bug13124()|
+drop procedure  bug13124|
+
 #
 # BUG#NNNN: New bug synopsis
 #

sql/item.cc

@@ -818,6 +818,8 @@ String *Item_splocal::val_str(String *sp)
   DBUG_ASSERT(fixed);
   Item *it= this_item();
   String *ret= it->val_str(sp);
+
+  null_value= it->null_value;
   /*
     This way we mark returned value of val_str as const,
     so that various functions (e.g. CONCAT) won't try to
@@ -833,9 +835,12 @@ String *Item_splocal::val_str(String *sp)
     This is intended behaviour of Item_func_concat. Comments to
     Item_param class contain some more details on the topic.
   */
+
+  if (!ret)
+    return NULL;
+
   str_value_ptr.set(ret->ptr(), ret->length(),
                     ret->charset());
-  null_value= it->null_value;
   return &str_value_ptr;
 }