Bug#22138: Unhandled NULL caused server crash

The Cached_item_decimal::cmp() method wasn't checking for null pointer
returned from the val_decimal() of the item being cached.
This leads to server crash.

The Cached_item_decimal::cmp() method now check for null values.


sql/item_buff.cc:
  Bug#22138: Unhandled NULL caused server crash
  The Cached_item_decimal::cmp() method now check for null values.
mysql-test/r/type_decimal.result:
  Added the test case for bug#22138: Unhandled NULL caused server crash
mysql-test/t/type_decimal.test:
  Added the test case for bug#22138: Unhandled NULL caused server crash

mysql-test/r/type_decimal.result

@@ -779,3 +779,14 @@ select f1 from t1 where f1 in (select f1 from t1);
 f1
 40
 drop table t1;
+create table t1 as
+select from_days(s) as date,t
+from (select 1 as s,'t' as t union select null, null ) as sub1;
+select group_concat(t) from t1 group by week(date)/10;
+group_concat(t)
+t
+Warnings:
+Warning	1292	Truncated incorrect datetime value: '0000-00-00'
+Warning	1292	Truncated incorrect datetime value: '0000-00-00'
+Warning	1292	Truncated incorrect datetime value: '0000-00-00'
+drop table t1;

mysql-test/t/type_decimal.test

@@ -385,3 +385,12 @@ insert into t1 values (40);
 flush tables;
 select f1 from t1 where f1 in (select f1 from t1);
 drop table t1;
+
+#
+# Bug#22183: Unhandled NULL caused server crash
+#
+create table t1 as
+ select from_days(s) as date,t
+ from (select 1 as s,'t' as t union select null, null ) as sub1;
+select group_concat(t) from t1 group by week(date)/10;
+drop table t1;

sql/item_buff.cc

@@ -132,13 +132,19 @@ bool Cached_item_decimal::cmp()
 {
   my_decimal tmp;
   my_decimal *ptmp= item->val_decimal(&tmp);
-  if (null_value != item->null_value || my_decimal_cmp(&value, ptmp))
+  if (null_value != item->null_value ||
+      (!item->null_value && my_decimal_cmp(&value, ptmp)))
   {
     null_value= item->null_value;
+    /* Save only not null values */
+    if (!null_value)
+    {
       my_decimal2decimal(ptmp, &value);
       return TRUE;
     }
     return FALSE;
+  }
+  return FALSE;
 }