diff --git a/mysql-test/r/ctype_ujis.result b/mysql-test/r/ctype_ujis.result
index 540ba178756ba8e5d3a53cfb5feab171611804a8..765ad5a96ca66e57eb972b7e9edb6b214c39fcef 100644
--- a/mysql-test/r/ctype_ujis.result
+++ b/mysql-test/r/ctype_ujis.result
@@ -2374,6 +2374,16 @@ hex(convert(_latin1 0xA4A2 using ujis))	hex(c2)
 DROP PROCEDURE sp1;
 DROP TABLE t1;
 DROP TABLE t2;
+#
+# Bug#57257 Replace(ExtractValue(...)) causes MySQL crash
+#
+SET NAMES utf8;
+SELECT CONVERT(REPLACE(EXPORT_SET('a','a','a','','a'),'00','') USING ujis);
+CONVERT(REPLACE(EXPORT_SET('a','a','a','','a'),'00','') USING ujis)
+
+Warnings:
+Warning	1292	Truncated incorrect INTEGER value: 'a'
+Warning	1292	Truncated incorrect INTEGER value: 'a'
 set names default;
 set character_set_database=default;
 set character_set_server=default;
diff --git a/mysql-test/r/xml.result b/mysql-test/r/xml.result
index fad2cab0e57791ac21b3c94533d68000d162b5da..e6811789679c61503eea1508dc8800aa0e847671 100644
--- a/mysql-test/r/xml.result
+++ b/mysql-test/r/xml.result
@@ -1093,4 +1093,17 @@ Warnings:
 Warning	1525	Incorrect XML value: 'parse error at line 1 pos 23: unexpected END-OF-INPUT'
 Warning	1525	Incorrect XML value: 'parse error at line 1 pos 23: unexpected END-OF-INPUT'
 DROP TABLE t1;
+#
+# Bug#57257 Replace(ExtractValue(...)) causes MySQL crash
+#
+SET NAMES utf8;
+SELECT REPLACE(EXTRACTVALUE('1', '/a'),'ds','');
+REPLACE(EXTRACTVALUE('1', '/a'),'ds','')
+
+#
+# Bug #57820 extractvalue crashes
+#
+SELECT AVG(DISTINCT EXTRACTVALUE((''),('$@k')));
+AVG(DISTINCT EXTRACTVALUE((''),('$@k')))
+NULL
 End of 5.1 tests
diff --git a/mysql-test/t/ctype_ujis.test b/mysql-test/t/ctype_ujis.test
index 400f1301dd387e8ef91fb71728894f0380469bf4..4c29a2e11a016fb06843f479ed40d85dfca27131 100644
--- a/mysql-test/t/ctype_ujis.test
+++ b/mysql-test/t/ctype_ujis.test
@@ -1209,6 +1209,13 @@ DROP PROCEDURE sp1;
 DROP TABLE t1;
 DROP TABLE t2;
 
+--echo #
+--echo # Bug#57257 Replace(ExtractValue(...)) causes MySQL crash
+--echo #
+SET NAMES utf8;
+SELECT CONVERT(REPLACE(EXPORT_SET('a','a','a','','a'),'00','') USING ujis);
+
+
 set names default;
 set character_set_database=default;
 set character_set_server=default;
diff --git a/mysql-test/t/xml.test b/mysql-test/t/xml.test
index 6e7d38cdfcaf3a4f4fd1833ec08e8c5324a80e9b..a8917fc9fe7f84000711404d3e3fb68cf2be79ed 100644
--- a/mysql-test/t/xml.test
+++ b/mysql-test/t/xml.test
@@ -617,4 +617,15 @@ FROM t1 ORDER BY t1.id;
 
 DROP TABLE t1;
 
+--echo #
+--echo # Bug#57257 Replace(ExtractValue(...)) causes MySQL crash
+--echo #
+SET NAMES utf8;
+SELECT REPLACE(EXTRACTVALUE('1', '/a'),'ds','');
+
+--echo #
+--echo # Bug #57820 extractvalue crashes
+--echo #
+SELECT AVG(DISTINCT EXTRACTVALUE((''),('$@k')));
+
 --echo End of 5.1 tests
diff --git a/sql/item_strfunc.cc b/sql/item_strfunc.cc
index 8fda281bd9e012c532ff5f8117692b869ad07311..fd5c47d25cb046c0c3b9232aa2cefbeb5a6b28c3 100644
--- a/sql/item_strfunc.cc
+++ b/sql/item_strfunc.cc
@@ -904,9 +904,15 @@ String *Item_func_replace::val_str(String *str)
     search=res2->ptr();
     search_end=search+from_length;
 redo:
+    DBUG_ASSERT(res->ptr() || !offset);
     ptr=res->ptr()+offset;
     strend=res->ptr()+res->length();
-    end=strend-from_length+1;
+    /*
+      In some cases val_str() can return empty string
+      with ptr() == NULL and length() == 0.
+      Let's check strend to avoid overflow.
+    */
+    end= strend ? strend - from_length + 1 : NULL;
     while (ptr < end)
     {
         if (*ptr == *search)
diff --git a/sql/item_xmlfunc.cc b/sql/item_xmlfunc.cc
index 3e20b90e68e3a8bc5d16249f4904bedd417e4244..364311877e0aa8c3f8467a70d6a9688a15ad9423 100644
--- a/sql/item_xmlfunc.cc
+++ b/sql/item_xmlfunc.cc
@@ -2790,12 +2790,12 @@ String *Item_func_xml_extractvalue::val_str(String *str)
   null_value= 0;
   if (!nodeset_func ||
       !(res= args[0]->val_str(str)) || 
-      !parse_xml(res, &pxml))
+      !parse_xml(res, &pxml) ||
+      !(res= nodeset_func->val_str(&tmp_value)))
   {
     null_value= 1;
     return 0;
   }
-  res= nodeset_func->val_str(&tmp_value);
   return res;  
 }