Bug#20752: BENCHMARK with many iterations returns too quickly

In BENCHMARK(count, expr), count could overflow/wrap-around.
Patch changes to a sufficiently large data-type. Adds a warning
for negative count values.

mysql-test/r/func_str.result

@@ -1431,6 +1431,11 @@ benchmark(100, NULL)
 select benchmark(NULL, 1+1);
 benchmark(NULL, 1+1)
 NULL
+select benchmark(-1, 1);
+benchmark(-1, 1)
+NULL
+Warnings:
+Error	1411	Incorrect count value: '-1' for function benchmark
 set @password="password";
 set @my_data="clear text to encode";
 select md5(encode(@my_data, "password"));

mysql-test/t/func_str.test

@@ -874,6 +874,13 @@ select benchmark(0, NULL);
 select benchmark(100, NULL);
 select benchmark(NULL, 1+1);
 
+#
+# Bug #20752: BENCHMARK with many iterations returns too quickly
+#
+
+# not a string, but belongs with the above Bug#22684
+select benchmark(-1, 1);
+
 #
 # Please note:
 # 1) The collation of the password is irrelevant, the encryption uses

sql/item_func.cc

@@ -3651,18 +3651,28 @@ longlong Item_func_benchmark::val_int()
   String tmp(buff,sizeof(buff), &my_charset_bin);
   my_decimal tmp_decimal;
   THD *thd=current_thd;
-  ulong loop_count;
+  ulonglong loop_count;
 
-  loop_count= (ulong) args[0]->val_int();
+  loop_count= (ulonglong) args[0]->val_int();
 
-  if (args[0]->null_value)
+  if (args[0]->null_value ||
+      (!args[0]->unsigned_flag && (((longlong) loop_count) < 0)))
+  {
+    if (!args[0]->null_value)
     {
+      char buff[22];
+      llstr(((longlong) loop_count), buff);
+      push_warning_printf(current_thd, MYSQL_ERROR::WARN_LEVEL_ERROR,
+                          ER_WRONG_VALUE_FOR_TYPE, ER(ER_WRONG_VALUE_FOR_TYPE),
+                          "count", buff, "benchmark");
+    }
+
     null_value= 1;
     return 0;
   }
 
   null_value=0;
-  for (ulong loop=0 ; loop < loop_count && !thd->killed; loop++)
+  for (ulonglong loop=0 ; loop < loop_count && !thd->killed; loop++)
   {
     switch (args[1]->result_type()) {
     case REAL_RESULT: