Merging from mysql-5.1-security

mysql-test/r/date_formats.result

@@ -544,3 +544,17 @@ SELECT DATE_FORMAT("2009-01-01",'%W %d %M %Y') as valid_date;
 valid_date
 Thursday 01 January 2009
 "End of 5.0 tests"
+#
+# Start of 5.1 tests
+#
+#
+# Bug#58005 utf8 + get_format causes failed assertion: !str || str != Ptr'
+#
+SET NAMES utf8;
+SELECT LEAST('%', GET_FORMAT(datetime, 'eur'), CAST(GET_FORMAT(datetime, 'eur') AS CHAR(65535)));
+LEAST('%', GET_FORMAT(datetime, 'eur'), CAST(GET_FORMAT(datetime, 'eur') AS CHAR(65535)))
+%
+SET NAMES latin1;
+#
+# End of 5.1 tests
+#

mysql-test/t/date_formats.test

@@ -354,3 +354,19 @@ SELECT DATE_FORMAT("0000-02-28",'%W %d %M %Y') as valid_date;
 SELECT DATE_FORMAT("2009-01-01",'%W %d %M %Y') as valid_date;
 
 --echo "End of 5.0 tests"
+
+
+--echo #
+--echo # Start of 5.1 tests
+--echo #
+
+--echo #
+--echo # Bug#58005 utf8 + get_format causes failed assertion: !str || str != Ptr'
+--echo #
+SET NAMES utf8;
+SELECT LEAST('%', GET_FORMAT(datetime, 'eur'), CAST(GET_FORMAT(datetime, 'eur') AS CHAR(65535)));
+SET NAMES latin1;
+
+--echo #
+--echo # End of 5.1 tests
+--echo #

sql/item_timefunc.cc

@@ -2526,14 +2526,14 @@ String *Item_char_typecast::val_str(String *str)
   {
     // Convert character set if differ
     uint dummy_errors;
-    if (!(res= args[0]->val_str(&tmp_value)) ||
-        str->copy(res->ptr(), res->length(), from_cs,
-        cast_cs, &dummy_errors))
+    if (!(res= args[0]->val_str(str)) ||
+        tmp_value.copy(res->ptr(), res->length(), from_cs,
+                       cast_cs, &dummy_errors))
     {
       null_value= 1;
       return 0;
     }
-    res= str;
+    res= &tmp_value;
   }
 
   res->set_charset(cast_cs);
@@ -2568,9 +2568,9 @@ String *Item_char_typecast::val_str(String *str)
     {
       if (res->alloced_length() < (uint) cast_length)
       {
-        str->alloc(cast_length);
-        str->copy(*res);
-        res= str;
+        str_value.alloc(cast_length);
+        str_value.copy(*res);
+        res= &str_value;
       }
       bzero((char*) res->ptr() + res->length(),
             (uint) cast_length - res->length());