Fixed Bug#10232: update with subquery, precision math,

another column gets rotten value.


mysql-test/r/type_newdecimal.result:
  Added a test case for Bug#10232: update with subquery, precision math,
  another column gets rotten value.
mysql-test/t/type_newdecimal.test:
  Added a test case for Bug#10232: update with subquery, precision math,
  another column gets rotten value.

mysql-test/r/type_newdecimal.result

@@ -863,3 +863,16 @@ select 0.190287977636363637 + 0.040372670 * 0 -  0;
 select -0.123 * 0;
 -0.123 * 0
 0.000
+CREATE TABLE t1 (f1 DECIMAL (12,9), f2 DECIMAL(2,2));
+INSERT INTO t1 VALUES (10.5, 0);
+UPDATE t1 SET f1 = 4.5;
+SELECT * FROM t1;
+f1	f2
+4.500000000	0.00
+DROP TABLE t1;
+CREATE TABLE t1 (f1 DECIMAL (64,20), f2 DECIMAL(2,2));
+INSERT INTO t1 VALUES (9999999999999999999999999999999999, 0);
+SELECT * FROM t1;
+f1	f2
+9999999999999999999999999999999999.00000000000000000000	0.00
+DROP TABLE t1;

mysql-test/t/type_newdecimal.test

@@ -892,3 +892,17 @@ select 0.190287977636363637 + 0.040372670 * 0 -  0;
 # Bug #9527
 #
 select -0.123 * 0;
+
+#
+# Bug #10232
+#
+
+CREATE TABLE t1 (f1 DECIMAL (12,9), f2 DECIMAL(2,2));
+INSERT INTO t1 VALUES (10.5, 0);
+UPDATE t1 SET f1 = 4.5;
+SELECT * FROM t1;
+DROP TABLE t1;
+CREATE TABLE t1 (f1 DECIMAL (64,20), f2 DECIMAL(2,2));
+INSERT INTO t1 VALUES (9999999999999999999999999999999999, 0);
+SELECT * FROM t1;
+DROP TABLE t1;

strings/decimal.c

@@ -1162,6 +1162,8 @@ int decimal2bin(decimal_t *from, char *to, int precision, int frac)
       isize0=intg0*sizeof(dec1)+dig2bytes[intg0x],
       fsize0=frac0*sizeof(dec1)+dig2bytes[frac0x],
       fsize1=frac1*sizeof(dec1)+dig2bytes[frac1x];
+  const int orig_isize0= isize0;
+  const int orig_fsize0= fsize0;
   char *orig_to= to;
 
   buf1= remove_leading_zeroes(from, &from_intg);
@@ -1252,10 +1254,15 @@ int decimal2bin(decimal_t *from, char *to, int precision, int frac)
   }
   if (fsize0 > fsize1)
   {
-    while (fsize0-- > fsize1)
+    char *to_end= orig_to + orig_fsize0 + orig_isize0;
+
+    while (fsize0-- > fsize1 && to < to_end)
       *to++=(uchar)mask;
   }
   orig_to[0]^= 0x80;
+
+  /* Check that we have written the whole decimal and nothing more */
+  DBUG_ASSERT(to == orig_to + orig_fsize0 + orig_isize0);
   return error;
 }