MDEV-22625 SIGSEGV in intern_find_sys_var (optimized builds)

The constructor of Lex_ident_sys returns LEX_CSTRING(NULL,0) if character set
conversion goes wrong, and raises the "wrong character string" error in
the diagnostics area.

The code in sql_yacc.yy did not check Lex_ident_sys::ptr against NULL,
so the execution entered functions that did not expect NULL (and crashed).

Fixing the code to do MYSQL_YYABORT if Lex_ident_sys::ptr is NULL
after constructing.

mysql-test/include/ctype_ident_sys.inc

+--echo #
+--echo # SET STATEMENT (bad|good.bad|bad.good)=1
+--echo #
+
+--error ER_INVALID_CHARACTER_STRING
+EXECUTE IMMEDIATE CONCAT('SET STATEMENT ',@seq, '=1 SELECT 1');
+
+--error ER_INVALID_CHARACTER_STRING
+EXECUTE IMMEDIATE CONCAT('SET STATEMENT ',@seq, '.a=1 SELECT 1');
+
+--error ER_INVALID_CHARACTER_STRING
+EXECUTE IMMEDIATE CONCAT('SET STATEMENT a.',@seq, '=1 SELECT 1');
+
+
+--echo #
+--echo # SET SESSION (bad|good.bad|bad.good)=1
+--echo #
+
+--error ER_INVALID_CHARACTER_STRING
+EXECUTE IMMEDIATE CONCAT('SET SESSION ',@seq, '=1 SELECT 1');
+
+--error ER_INVALID_CHARACTER_STRING
+EXECUTE IMMEDIATE CONCAT('SET SESSION ',@seq, '.a=1 SELECT 1');
+
+--error ER_INVALID_CHARACTER_STRING
+EXECUTE IMMEDIATE CONCAT('SET SESSION a.',@seq, '=1 SELECT 1');
+
+
+--echo #
+--echo # SET (bad|good.bad|bad.good)=1
+--echo #
+
+
+--error ER_INVALID_CHARACTER_STRING
+EXECUTE IMMEDIATE CONCAT('SET ', @seq, '=1');
+
+--error ER_INVALID_CHARACTER_STRING
+EXECUTE IMMEDIATE CONCAT('SET ', @seq, '.a=1');
+
+--error ER_INVALID_CHARACTER_STRING
+EXECUTE IMMEDIATE CONCAT('SET a.', @seq, '=1');
+
+
+--echo #
+--echo # Oracle SP call: BEGIN (bad|good.bad|bad.good)(params); END
+--echo #
+
+SET sql_mode=ORACLE;
+--error ER_INVALID_CHARACTER_STRING
+EXECUTE IMMEDIATE CONCAT('BEGIN ',@seq, '(1); END;');
+
+--error ER_INVALID_CHARACTER_STRING
+EXECUTE IMMEDIATE CONCAT('BEGIN ',@seq, '.a(1); END;');
+
+--error ER_INVALID_CHARACTER_STRING
+EXECUTE IMMEDIATE CONCAT('BEGIN a.',@seq, '(1); END;');
+
+
+--echo #
+--echo # Oracle assignment: (bad|good.bad|bad.good):= value
+--echo #
+
+--error ER_INVALID_CHARACTER_STRING
+EXECUTE IMMEDIATE CONCAT(@seq, ':=1');
+
+--error ER_INVALID_CHARACTER_STRING
+EXECUTE IMMEDIATE CONCAT(@seq, '.a:=1');
+
+--error ER_INVALID_CHARACTER_STRING
+EXECUTE IMMEDIATE CONCAT('a.', @seq, ':=1');
+
+
+SET sql_mode=DEFAULT;

mysql-test/main/ctype_big5.result

@@ -5384,3 +5384,61 @@ SET DEFAULT_STORAGE_ENGINE=Default;
 #
 # End of 10.2 tests
 #
+#
+# Start of 10.5 tests
+#
+#
+# MDEV-22625 SIGSEGV in intern_find_sys_var (optimized builds)
+#
+SET NAMES big5;
+SET @seq=_big5 0xA3C0;
+#
+# SET STATEMENT (bad|good.bad|bad.good)=1
+#
+EXECUTE IMMEDIATE CONCAT('SET STATEMENT ',@seq, '=1 SELECT 1');
+ERROR HY000: Invalid big5 character string: '\xA3\xC0'
+EXECUTE IMMEDIATE CONCAT('SET STATEMENT ',@seq, '.a=1 SELECT 1');
+ERROR HY000: Invalid big5 character string: '\xA3\xC0'
+EXECUTE IMMEDIATE CONCAT('SET STATEMENT a.',@seq, '=1 SELECT 1');
+ERROR HY000: Invalid big5 character string: '\xA3\xC0'
+#
+# SET SESSION (bad|good.bad|bad.good)=1
+#
+EXECUTE IMMEDIATE CONCAT('SET SESSION ',@seq, '=1 SELECT 1');
+ERROR HY000: Invalid big5 character string: '\xA3\xC0'
+EXECUTE IMMEDIATE CONCAT('SET SESSION ',@seq, '.a=1 SELECT 1');
+ERROR HY000: Invalid big5 character string: '\xA3\xC0'
+EXECUTE IMMEDIATE CONCAT('SET SESSION a.',@seq, '=1 SELECT 1');
+ERROR HY000: Invalid big5 character string: '\xA3\xC0'
+#
+# SET (bad|good.bad|bad.good)=1
+#
+EXECUTE IMMEDIATE CONCAT('SET ', @seq, '=1');
+ERROR HY000: Invalid big5 character string: '\xA3\xC0'
+EXECUTE IMMEDIATE CONCAT('SET ', @seq, '.a=1');
+ERROR HY000: Invalid big5 character string: '\xA3\xC0'
+EXECUTE IMMEDIATE CONCAT('SET a.', @seq, '=1');
+ERROR HY000: Invalid big5 character string: '\xA3\xC0'
+#
+# Oracle SP call: BEGIN (bad|good.bad|bad.good)(params); END
+#
+SET sql_mode=ORACLE;
+EXECUTE IMMEDIATE CONCAT('BEGIN ',@seq, '(1); END;');
+ERROR HY000: Invalid big5 character string: '\xA3\xC0'
+EXECUTE IMMEDIATE CONCAT('BEGIN ',@seq, '.a(1); END;');
+ERROR HY000: Invalid big5 character string: '\xA3\xC0'
+EXECUTE IMMEDIATE CONCAT('BEGIN a.',@seq, '(1); END;');
+ERROR HY000: Invalid big5 character string: '\xA3\xC0'
+#
+# Oracle assignment: (bad|good.bad|bad.good):= value
+#
+EXECUTE IMMEDIATE CONCAT(@seq, ':=1');
+ERROR HY000: Invalid big5 character string: '\xA3\xC0'
+EXECUTE IMMEDIATE CONCAT(@seq, '.a:=1');
+ERROR HY000: Invalid big5 character string: '\xA3\xC0'
+EXECUTE IMMEDIATE CONCAT('a.', @seq, ':=1');
+ERROR HY000: Invalid big5 character string: '\xA3\xC0'
+SET sql_mode=DEFAULT;
+#
+# End of 10.5 tests
+#

mysql-test/main/ctype_big5.test

@@ -269,3 +269,20 @@ let $coll_pad='big5_bin';
 --echo #
 --echo # End of 10.2 tests
 --echo #
+
+
+--echo #
+--echo # Start of 10.5 tests
+--echo #
+
+--echo #
+--echo # MDEV-22625 SIGSEGV in intern_find_sys_var (optimized builds)
+--echo #
+
+SET NAMES big5;
+SET @seq=_big5 0xA3C0;
+--source include/ctype_ident_sys.inc
+
+--echo #
+--echo # End of 10.5 tests
+--echo #

mysql-test/main/ctype_cp932.result

@@ -597,3 +597,61 @@ SET DEFAULT_STORAGE_ENGINE=Default;
 #
 # End of 10.2 tests
 #
+#
+# Start of 10.5 tests
+#
+#
+# MDEV-22625 SIGSEGV in intern_find_sys_var (optimized builds)
+#
+SET NAMES cp932;
+SET @seq=_cp932 0x81AD;
+#
+# SET STATEMENT (bad|good.bad|bad.good)=1
+#
+EXECUTE IMMEDIATE CONCAT('SET STATEMENT ',@seq, '=1 SELECT 1');
+ERROR HY000: Invalid cp932 character string: '\x81\xAD'
+EXECUTE IMMEDIATE CONCAT('SET STATEMENT ',@seq, '.a=1 SELECT 1');
+ERROR HY000: Invalid cp932 character string: '\x81\xAD'
+EXECUTE IMMEDIATE CONCAT('SET STATEMENT a.',@seq, '=1 SELECT 1');
+ERROR HY000: Invalid cp932 character string: '\x81\xAD'
+#
+# SET SESSION (bad|good.bad|bad.good)=1
+#
+EXECUTE IMMEDIATE CONCAT('SET SESSION ',@seq, '=1 SELECT 1');
+ERROR HY000: Invalid cp932 character string: '\x81\xAD'
+EXECUTE IMMEDIATE CONCAT('SET SESSION ',@seq, '.a=1 SELECT 1');
+ERROR HY000: Invalid cp932 character string: '\x81\xAD'
+EXECUTE IMMEDIATE CONCAT('SET SESSION a.',@seq, '=1 SELECT 1');
+ERROR HY000: Invalid cp932 character string: '\x81\xAD'
+#
+# SET (bad|good.bad|bad.good)=1
+#
+EXECUTE IMMEDIATE CONCAT('SET ', @seq, '=1');
+ERROR HY000: Invalid cp932 character string: '\x81\xAD'
+EXECUTE IMMEDIATE CONCAT('SET ', @seq, '.a=1');
+ERROR HY000: Invalid cp932 character string: '\x81\xAD'
+EXECUTE IMMEDIATE CONCAT('SET a.', @seq, '=1');
+ERROR HY000: Invalid cp932 character string: '\x81\xAD'
+#
+# Oracle SP call: BEGIN (bad|good.bad|bad.good)(params); END
+#
+SET sql_mode=ORACLE;
+EXECUTE IMMEDIATE CONCAT('BEGIN ',@seq, '(1); END;');
+ERROR HY000: Invalid cp932 character string: '\x81\xAD'
+EXECUTE IMMEDIATE CONCAT('BEGIN ',@seq, '.a(1); END;');
+ERROR HY000: Invalid cp932 character string: '\x81\xAD'
+EXECUTE IMMEDIATE CONCAT('BEGIN a.',@seq, '(1); END;');
+ERROR HY000: Invalid cp932 character string: '\x81\xAD'
+#
+# Oracle assignment: (bad|good.bad|bad.good):= value
+#
+EXECUTE IMMEDIATE CONCAT(@seq, ':=1');
+ERROR HY000: Invalid cp932 character string: '\x81\xAD'
+EXECUTE IMMEDIATE CONCAT(@seq, '.a:=1');
+ERROR HY000: Invalid cp932 character string: '\x81\xAD'
+EXECUTE IMMEDIATE CONCAT('a.', @seq, ':=1');
+ERROR HY000: Invalid cp932 character string: '\x81\xAD'
+SET sql_mode=DEFAULT;
+#
+# End of 10.5 tests
+#

mysql-test/main/ctype_cp932.test

@@ -47,3 +47,20 @@ let $coll_pad='cp932_bin';
 --echo #
 --echo # End of 10.2 tests
 --echo #
+
+
+--echo #
+--echo # Start of 10.5 tests
+--echo #
+
+--echo #
+--echo # MDEV-22625 SIGSEGV in intern_find_sys_var (optimized builds)
+--echo #
+
+SET NAMES cp932;
+SET @seq=_cp932 0x81AD;
+--source include/ctype_ident_sys.inc
+
+--echo #
+--echo # End of 10.5 tests
+--echo #

mysql-test/main/ctype_dec8.result

+#
+# Start of 10.5 tests
+#
+#
+# MDEV-22625 SIGSEGV in intern_find_sys_var (optimized builds)
+#
+SET NAMES dec8;
+SET @seq=_dec8 0xD0;
+#
+# SET STATEMENT (bad|good.bad|bad.good)=1
+#
+EXECUTE IMMEDIATE CONCAT('SET STATEMENT ',@seq, '=1 SELECT 1');
+ERROR HY000: Invalid dec8 character string: '\xD0'
+EXECUTE IMMEDIATE CONCAT('SET STATEMENT ',@seq, '.a=1 SELECT 1');
+ERROR HY000: Invalid dec8 character string: '\xD0'
+EXECUTE IMMEDIATE CONCAT('SET STATEMENT a.',@seq, '=1 SELECT 1');
+ERROR HY000: Invalid dec8 character string: '\xD0'
+#
+# SET SESSION (bad|good.bad|bad.good)=1
+#
+EXECUTE IMMEDIATE CONCAT('SET SESSION ',@seq, '=1 SELECT 1');
+ERROR HY000: Invalid dec8 character string: '\xD0'
+EXECUTE IMMEDIATE CONCAT('SET SESSION ',@seq, '.a=1 SELECT 1');
+ERROR HY000: Invalid dec8 character string: '\xD0'
+EXECUTE IMMEDIATE CONCAT('SET SESSION a.',@seq, '=1 SELECT 1');
+ERROR HY000: Invalid dec8 character string: '\xD0'
+#
+# SET (bad|good.bad|bad.good)=1
+#
+EXECUTE IMMEDIATE CONCAT('SET ', @seq, '=1');
+ERROR HY000: Invalid dec8 character string: '\xD0'
+EXECUTE IMMEDIATE CONCAT('SET ', @seq, '.a=1');
+ERROR HY000: Invalid dec8 character string: '\xD0'
+EXECUTE IMMEDIATE CONCAT('SET a.', @seq, '=1');
+ERROR HY000: Invalid dec8 character string: '\xD0'
+#
+# Oracle SP call: BEGIN (bad|good.bad|bad.good)(params); END
+#
+SET sql_mode=ORACLE;
+EXECUTE IMMEDIATE CONCAT('BEGIN ',@seq, '(1); END;');
+ERROR HY000: Invalid dec8 character string: '\xD0'
+EXECUTE IMMEDIATE CONCAT('BEGIN ',@seq, '.a(1); END;');
+ERROR HY000: Invalid dec8 character string: '\xD0'
+EXECUTE IMMEDIATE CONCAT('BEGIN a.',@seq, '(1); END;');
+ERROR HY000: Invalid dec8 character string: '\xD0'
+#
+# Oracle assignment: (bad|good.bad|bad.good):= value
+#
+EXECUTE IMMEDIATE CONCAT(@seq, ':=1');
+ERROR HY000: Invalid dec8 character string: '\xD0'
+EXECUTE IMMEDIATE CONCAT(@seq, '.a:=1');
+ERROR HY000: Invalid dec8 character string: '\xD0'
+EXECUTE IMMEDIATE CONCAT('a.', @seq, ':=1');
+ERROR HY000: Invalid dec8 character string: '\xD0'
+SET sql_mode=DEFAULT;
+#
+# End of 10.5 tests
+#

mysql-test/main/ctype_dec8.test

+--echo #
+--echo # Start of 10.5 tests
+--echo #
+
+--echo #
+--echo # MDEV-22625 SIGSEGV in intern_find_sys_var (optimized builds)
+--echo #
+
+SET NAMES dec8;
+SET @seq=_dec8 0xD0;
+--source include/ctype_ident_sys.inc
+
+--echo #
+--echo # End of 10.5 tests
+--echo #

mysql-test/main/ctype_eucjpms.result

@@ -34491,3 +34491,61 @@ SET DEFAULT_STORAGE_ENGINE=Default;
 #
 # End of 10.2 tests
 #
+#
+# Start of 10.5 tests
+#
+#
+# MDEV-22625 SIGSEGV in intern_find_sys_var (optimized builds)
+#
+SET NAMES eucjpms;
+SET @seq=_eucjpms 0x8FA1A1;
+#
+# SET STATEMENT (bad|good.bad|bad.good)=1
+#
+EXECUTE IMMEDIATE CONCAT('SET STATEMENT ',@seq, '=1 SELECT 1');
+ERROR HY000: Invalid eucjpms character string: '\x8F\xA1\xA1'
+EXECUTE IMMEDIATE CONCAT('SET STATEMENT ',@seq, '.a=1 SELECT 1');
+ERROR HY000: Invalid eucjpms character string: '\x8F\xA1\xA1'
+EXECUTE IMMEDIATE CONCAT('SET STATEMENT a.',@seq, '=1 SELECT 1');
+ERROR HY000: Invalid eucjpms character string: '\x8F\xA1\xA1'
+#
+# SET SESSION (bad|good.bad|bad.good)=1
+#
+EXECUTE IMMEDIATE CONCAT('SET SESSION ',@seq, '=1 SELECT 1');
+ERROR HY000: Invalid eucjpms character string: '\x8F\xA1\xA1'
+EXECUTE IMMEDIATE CONCAT('SET SESSION ',@seq, '.a=1 SELECT 1');
+ERROR HY000: Invalid eucjpms character string: '\x8F\xA1\xA1'
+EXECUTE IMMEDIATE CONCAT('SET SESSION a.',@seq, '=1 SELECT 1');
+ERROR HY000: Invalid eucjpms character string: '\x8F\xA1\xA1'
+#
+# SET (bad|good.bad|bad.good)=1
+#
+EXECUTE IMMEDIATE CONCAT('SET ', @seq, '=1');
+ERROR HY000: Invalid eucjpms character string: '\x8F\xA1\xA1'
+EXECUTE IMMEDIATE CONCAT('SET ', @seq, '.a=1');
+ERROR HY000: Invalid eucjpms character string: '\x8F\xA1\xA1'
+EXECUTE IMMEDIATE CONCAT('SET a.', @seq, '=1');
+ERROR HY000: Invalid eucjpms character string: '\x8F\xA1\xA1'
+#
+# Oracle SP call: BEGIN (bad|good.bad|bad.good)(params); END
+#
+SET sql_mode=ORACLE;
+EXECUTE IMMEDIATE CONCAT('BEGIN ',@seq, '(1); END;');
+ERROR HY000: Invalid eucjpms character string: '\x8F\xA1\xA1'
+EXECUTE IMMEDIATE CONCAT('BEGIN ',@seq, '.a(1); END;');
+ERROR HY000: Invalid eucjpms character string: '\x8F\xA1\xA1'
+EXECUTE IMMEDIATE CONCAT('BEGIN a.',@seq, '(1); END;');
+ERROR HY000: Invalid eucjpms character string: '\x8F\xA1\xA1'
+#
+# Oracle assignment: (bad|good.bad|bad.good):= value
+#
+EXECUTE IMMEDIATE CONCAT(@seq, ':=1');
+ERROR HY000: Invalid eucjpms character string: '\x8F\xA1\xA1'
+EXECUTE IMMEDIATE CONCAT(@seq, '.a:=1');
+ERROR HY000: Invalid eucjpms character string: '\x8F\xA1\xA1'
+EXECUTE IMMEDIATE CONCAT('a.', @seq, ':=1');
+ERROR HY000: Invalid eucjpms character string: '\x8F\xA1\xA1'
+SET sql_mode=DEFAULT;
+#
+# End of 10.5 tests
+#

mysql-test/main/ctype_eucjpms.test

@@ -596,3 +596,20 @@ let $coll_pad='eucjpms_bin';
 --echo #
 --echo # End of 10.2 tests
 --echo #
+
+
+--echo #
+--echo # Start of 10.5 tests
+--echo #
+
+--echo #
+--echo # MDEV-22625 SIGSEGV in intern_find_sys_var (optimized builds)
+--echo #
+
+SET NAMES eucjpms;
+SET @seq=_eucjpms 0x8FA1A1;
+--source include/ctype_ident_sys.inc
+
+--echo #
+--echo # End of 10.5 tests
+--echo #

mysql-test/main/ctype_euckr.result

@@ -26009,3 +26009,61 @@ SET DEFAULT_STORAGE_ENGINE=Default;
 #
 # End of 10.2 tests
 #
+#
+# Start of 10.5 tests
+#
+#
+# MDEV-22625 SIGSEGV in intern_find_sys_var (optimized builds)
+#
+SET NAMES euckr;
+SET @seq=_euckr 0xA2E8;
+#
+# SET STATEMENT (bad|good.bad|bad.good)=1
+#
+EXECUTE IMMEDIATE CONCAT('SET STATEMENT ',@seq, '=1 SELECT 1');
+ERROR HY000: Invalid euckr character string: '\xA2\xE8'
+EXECUTE IMMEDIATE CONCAT('SET STATEMENT ',@seq, '.a=1 SELECT 1');
+ERROR HY000: Invalid euckr character string: '\xA2\xE8'
+EXECUTE IMMEDIATE CONCAT('SET STATEMENT a.',@seq, '=1 SELECT 1');
+ERROR HY000: Invalid euckr character string: '\xA2\xE8'
+#
+# SET SESSION (bad|good.bad|bad.good)=1
+#
+EXECUTE IMMEDIATE CONCAT('SET SESSION ',@seq, '=1 SELECT 1');
+ERROR HY000: Invalid euckr character string: '\xA2\xE8'
+EXECUTE IMMEDIATE CONCAT('SET SESSION ',@seq, '.a=1 SELECT 1');
+ERROR HY000: Invalid euckr character string: '\xA2\xE8'
+EXECUTE IMMEDIATE CONCAT('SET SESSION a.',@seq, '=1 SELECT 1');
+ERROR HY000: Invalid euckr character string: '\xA2\xE8'
+#
+# SET (bad|good.bad|bad.good)=1
+#
+EXECUTE IMMEDIATE CONCAT('SET ', @seq, '=1');
+ERROR HY000: Invalid euckr character string: '\xA2\xE8'
+EXECUTE IMMEDIATE CONCAT('SET ', @seq, '.a=1');
+ERROR HY000: Invalid euckr character string: '\xA2\xE8'
+EXECUTE IMMEDIATE CONCAT('SET a.', @seq, '=1');
+ERROR HY000: Invalid euckr character string: '\xA2\xE8'
+#
+# Oracle SP call: BEGIN (bad|good.bad|bad.good)(params); END
+#
+SET sql_mode=ORACLE;
+EXECUTE IMMEDIATE CONCAT('BEGIN ',@seq, '(1); END;');
+ERROR HY000: Invalid euckr character string: '\xA2\xE8'
+EXECUTE IMMEDIATE CONCAT('BEGIN ',@seq, '.a(1); END;');
+ERROR HY000: Invalid euckr character string: '\xA2\xE8'
+EXECUTE IMMEDIATE CONCAT('BEGIN a.',@seq, '(1); END;');
+ERROR HY000: Invalid euckr character string: '\xA2\xE8'
+#
+# Oracle assignment: (bad|good.bad|bad.good):= value
+#
+EXECUTE IMMEDIATE CONCAT(@seq, ':=1');
+ERROR HY000: Invalid euckr character string: '\xA2\xE8'
+EXECUTE IMMEDIATE CONCAT(@seq, '.a:=1');
+ERROR HY000: Invalid euckr character string: '\xA2\xE8'
+EXECUTE IMMEDIATE CONCAT('a.', @seq, ':=1');
+ERROR HY000: Invalid euckr character string: '\xA2\xE8'
+SET sql_mode=DEFAULT;
+#
+# End of 10.5 tests
+#

mysql-test/main/ctype_euckr.test

@@ -227,3 +227,20 @@ let $coll_pad='euckr_bin';
 --echo #
 --echo # End of 10.2 tests
 --echo #
+
+
+--echo #
+--echo # Start of 10.5 tests
+--echo #
+
+--echo #
+--echo # MDEV-22625 SIGSEGV in intern_find_sys_var (optimized builds)
+--echo #
+
+SET NAMES euckr;
+SET @seq=_euckr 0xA2E8;
+--source include/ctype_ident_sys.inc
+
+--echo #
+--echo # End of 10.5 tests
+--echo #

mysql-test/main/ctype_gb2312.result

@@ -5079,3 +5079,61 @@ SET DEFAULT_STORAGE_ENGINE=Default;
 #
 # End of 10.2 tests
 #
+#
+# Start of 10.5 tests
+#
+#
+# MDEV-22625 SIGSEGV in intern_find_sys_var (optimized builds)
+#
+SET NAMES gb2312;
+SET @seq=_gb2312 0xA2A1;
+#
+# SET STATEMENT (bad|good.bad|bad.good)=1
+#
+EXECUTE IMMEDIATE CONCAT('SET STATEMENT ',@seq, '=1 SELECT 1');
+ERROR HY000: Invalid gb2312 character string: '\xA2\xA1'
+EXECUTE IMMEDIATE CONCAT('SET STATEMENT ',@seq, '.a=1 SELECT 1');
+ERROR HY000: Invalid gb2312 character string: '\xA2\xA1'
+EXECUTE IMMEDIATE CONCAT('SET STATEMENT a.',@seq, '=1 SELECT 1');
+ERROR HY000: Invalid gb2312 character string: '\xA2\xA1'
+#
+# SET SESSION (bad|good.bad|bad.good)=1
+#
+EXECUTE IMMEDIATE CONCAT('SET SESSION ',@seq, '=1 SELECT 1');
+ERROR HY000: Invalid gb2312 character string: '\xA2\xA1'
+EXECUTE IMMEDIATE CONCAT('SET SESSION ',@seq, '.a=1 SELECT 1');
+ERROR HY000: Invalid gb2312 character string: '\xA2\xA1'
+EXECUTE IMMEDIATE CONCAT('SET SESSION a.',@seq, '=1 SELECT 1');
+ERROR HY000: Invalid gb2312 character string: '\xA2\xA1'
+#
+# SET (bad|good.bad|bad.good)=1
+#
+EXECUTE IMMEDIATE CONCAT('SET ', @seq, '=1');
+ERROR HY000: Invalid gb2312 character string: '\xA2\xA1'
+EXECUTE IMMEDIATE CONCAT('SET ', @seq, '.a=1');
+ERROR HY000: Invalid gb2312 character string: '\xA2\xA1'
+EXECUTE IMMEDIATE CONCAT('SET a.', @seq, '=1');
+ERROR HY000: Invalid gb2312 character string: '\xA2\xA1'
+#
+# Oracle SP call: BEGIN (bad|good.bad|bad.good)(params); END
+#
+SET sql_mode=ORACLE;
+EXECUTE IMMEDIATE CONCAT('BEGIN ',@seq, '(1); END;');
+ERROR HY000: Invalid gb2312 character string: '\xA2\xA1'
+EXECUTE IMMEDIATE CONCAT('BEGIN ',@seq, '.a(1); END;');
+ERROR HY000: Invalid gb2312 character string: '\xA2\xA1'
+EXECUTE IMMEDIATE CONCAT('BEGIN a.',@seq, '(1); END;');
+ERROR HY000: Invalid gb2312 character string: '\xA2\xA1'
+#
+# Oracle assignment: (bad|good.bad|bad.good):= value
+#
+EXECUTE IMMEDIATE CONCAT(@seq, ':=1');
+ERROR HY000: Invalid gb2312 character string: '\xA2\xA1'
+EXECUTE IMMEDIATE CONCAT(@seq, '.a:=1');
+ERROR HY000: Invalid gb2312 character string: '\xA2\xA1'
+EXECUTE IMMEDIATE CONCAT('a.', @seq, ':=1');
+ERROR HY000: Invalid gb2312 character string: '\xA2\xA1'
+SET sql_mode=DEFAULT;
+#
+# End of 10.5 tests
+#

mysql-test/main/ctype_gb2312.test

@@ -180,3 +180,20 @@ let $coll_pad='gb2312_bin';
 --echo #
 --echo # End of 10.2 tests
 --echo #
+
+
+--echo #
+--echo # Start of 10.5 tests
+--echo #
+
+--echo #
+--echo # MDEV-22625 SIGSEGV in intern_find_sys_var (optimized builds)
+--echo #
+
+SET NAMES gb2312;
+SET @seq=_gb2312 0xA2A1;
+--source include/ctype_ident_sys.inc
+
+--echo #
+--echo # End of 10.5 tests
+--echo #

mysql-test/main/ctype_gbk.result

@@ -6542,3 +6542,61 @@ SET DEFAULT_STORAGE_ENGINE=Default;
 #
 # End of 10.2 tests
 #
+#
+# Start of 10.5 tests
+#
+#
+# MDEV-22625 SIGSEGV in intern_find_sys_var (optimized builds)
+#
+SET NAMES gbk;
+SET @seq=_gbk 0xAAA1;
+#
+# SET STATEMENT (bad|good.bad|bad.good)=1
+#
+EXECUTE IMMEDIATE CONCAT('SET STATEMENT ',@seq, '=1 SELECT 1');
+ERROR HY000: Invalid gbk character string: '\xAA\xA1'
+EXECUTE IMMEDIATE CONCAT('SET STATEMENT ',@seq, '.a=1 SELECT 1');
+ERROR HY000: Invalid gbk character string: '\xAA\xA1'
+EXECUTE IMMEDIATE CONCAT('SET STATEMENT a.',@seq, '=1 SELECT 1');
+ERROR HY000: Invalid gbk character string: '\xAA\xA1'
+#
+# SET SESSION (bad|good.bad|bad.good)=1
+#
+EXECUTE IMMEDIATE CONCAT('SET SESSION ',@seq, '=1 SELECT 1');
+ERROR HY000: Invalid gbk character string: '\xAA\xA1'
+EXECUTE IMMEDIATE CONCAT('SET SESSION ',@seq, '.a=1 SELECT 1');
+ERROR HY000: Invalid gbk character string: '\xAA\xA1'
+EXECUTE IMMEDIATE CONCAT('SET SESSION a.',@seq, '=1 SELECT 1');
+ERROR HY000: Invalid gbk character string: '\xAA\xA1'
+#
+# SET (bad|good.bad|bad.good)=1
+#
+EXECUTE IMMEDIATE CONCAT('SET ', @seq, '=1');
+ERROR HY000: Invalid gbk character string: '\xAA\xA1'
+EXECUTE IMMEDIATE CONCAT('SET ', @seq, '.a=1');
+ERROR HY000: Invalid gbk character string: '\xAA\xA1'
+EXECUTE IMMEDIATE CONCAT('SET a.', @seq, '=1');
+ERROR HY000: Invalid gbk character string: '\xAA\xA1'
+#
+# Oracle SP call: BEGIN (bad|good.bad|bad.good)(params); END
+#
+SET sql_mode=ORACLE;
+EXECUTE IMMEDIATE CONCAT('BEGIN ',@seq, '(1); END;');
+ERROR HY000: Invalid gbk character string: '\xAA\xA1'
+EXECUTE IMMEDIATE CONCAT('BEGIN ',@seq, '.a(1); END;');
+ERROR HY000: Invalid gbk character string: '\xAA\xA1'
+EXECUTE IMMEDIATE CONCAT('BEGIN a.',@seq, '(1); END;');
+ERROR HY000: Invalid gbk character string: '\xAA\xA1'
+#
+# Oracle assignment: (bad|good.bad|bad.good):= value
+#
+EXECUTE IMMEDIATE CONCAT(@seq, ':=1');
+ERROR HY000: Invalid gbk character string: '\xAA\xA1'
+EXECUTE IMMEDIATE CONCAT(@seq, '.a:=1');
+ERROR HY000: Invalid gbk character string: '\xAA\xA1'
+EXECUTE IMMEDIATE CONCAT('a.', @seq, ':=1');
+ERROR HY000: Invalid gbk character string: '\xAA\xA1'
+SET sql_mode=DEFAULT;
+#
+# End of 10.5 tests
+#

mysql-test/main/ctype_gbk.test

@@ -484,3 +484,20 @@ let $coll_pad='gbk_bin';
 --echo #
 --echo # End of 10.2 tests
 --echo #
+
+
+--echo #
+--echo # Start of 10.5 tests
+--echo #
+
+--echo #
+--echo # MDEV-22625 SIGSEGV in intern_find_sys_var (optimized builds)
+--echo #
+
+SET NAMES gbk;
+SET @seq=_gbk 0xAAA1;
+--source include/ctype_ident_sys.inc
+
+--echo #
+--echo # End of 10.5 tests
+--echo #

mysql-test/main/ctype_sjis.result

@@ -19318,3 +19318,61 @@ SET NAMES sjis;
 #
 # End of 10.5 tests
 #
+#
+# Start of 10.5 tests
+#
+#
+# MDEV-22625 SIGSEGV in intern_find_sys_var (optimized builds)
+#
+SET NAMES sjis;
+SET @seq=_sjis 0x81AD;
+#
+# SET STATEMENT (bad|good.bad|bad.good)=1
+#
+EXECUTE IMMEDIATE CONCAT('SET STATEMENT ',@seq, '=1 SELECT 1');
+ERROR HY000: Invalid sjis character string: '_x81_xAD'
+EXECUTE IMMEDIATE CONCAT('SET STATEMENT ',@seq, '.a=1 SELECT 1');
+ERROR HY000: Invalid sjis character string: '_x81_xAD'
+EXECUTE IMMEDIATE CONCAT('SET STATEMENT a.',@seq, '=1 SELECT 1');
+ERROR HY000: Invalid sjis character string: '_x81_xAD'
+#
+# SET SESSION (bad|good.bad|bad.good)=1
+#
+EXECUTE IMMEDIATE CONCAT('SET SESSION ',@seq, '=1 SELECT 1');
+ERROR HY000: Invalid sjis character string: '_x81_xAD'
+EXECUTE IMMEDIATE CONCAT('SET SESSION ',@seq, '.a=1 SELECT 1');
+ERROR HY000: Invalid sjis character string: '_x81_xAD'
+EXECUTE IMMEDIATE CONCAT('SET SESSION a.',@seq, '=1 SELECT 1');
+ERROR HY000: Invalid sjis character string: '_x81_xAD'
+#
+# SET (bad|good.bad|bad.good)=1
+#
+EXECUTE IMMEDIATE CONCAT('SET ', @seq, '=1');
+ERROR HY000: Invalid sjis character string: '_x81_xAD'
+EXECUTE IMMEDIATE CONCAT('SET ', @seq, '.a=1');
+ERROR HY000: Invalid sjis character string: '_x81_xAD'
+EXECUTE IMMEDIATE CONCAT('SET a.', @seq, '=1');
+ERROR HY000: Invalid sjis character string: '_x81_xAD'
+#
+# Oracle SP call: BEGIN (bad|good.bad|bad.good)(params); END
+#
+SET sql_mode=ORACLE;
+EXECUTE IMMEDIATE CONCAT('BEGIN ',@seq, '(1); END;');
+ERROR HY000: Invalid sjis character string: '_x81_xAD'
+EXECUTE IMMEDIATE CONCAT('BEGIN ',@seq, '.a(1); END;');
+ERROR HY000: Invalid sjis character string: '_x81_xAD'
+EXECUTE IMMEDIATE CONCAT('BEGIN a.',@seq, '(1); END;');
+ERROR HY000: Invalid sjis character string: '_x81_xAD'
+#
+# Oracle assignment: (bad|good.bad|bad.good):= value
+#
+EXECUTE IMMEDIATE CONCAT(@seq, ':=1');
+ERROR HY000: Invalid sjis character string: '_x81_xAD'
+EXECUTE IMMEDIATE CONCAT(@seq, '.a:=1');
+ERROR HY000: Invalid sjis character string: '_x81_xAD'
+EXECUTE IMMEDIATE CONCAT('a.', @seq, ':=1');
+ERROR HY000: Invalid sjis character string: '_x81_xAD'
+SET sql_mode=DEFAULT;
+#
+# End of 10.5 tests
+#

mysql-test/main/ctype_sjis.test

@@ -290,3 +290,20 @@ SET NAMES sjis;
 --echo #
 --echo # End of 10.5 tests
 --echo #
+
+
+--echo #
+--echo # Start of 10.5 tests
+--echo #
+
+--echo #
+--echo # MDEV-22625 SIGSEGV in intern_find_sys_var (optimized builds)
+--echo #
+
+SET NAMES sjis;
+SET @seq=_sjis 0x81AD;
+--source include/ctype_ident_sys.inc
+
+--echo #
+--echo # End of 10.5 tests
+--echo #

sql/sql_yacc.yy

@@ -16176,13 +16176,15 @@ set_stmt_option:
           ident_cli equal set_expr_or_default
           {
             Lex_ident_sys tmp(thd, &$1);
-            if (unlikely(Lex->set_system_variable(Lex->option_type, &tmp, $3)))
+            if (unlikely(!tmp.str) ||
+                unlikely(Lex->set_system_variable(Lex->option_type, &tmp, $3)))
               MYSQL_YYABORT;
           }
         | ident_cli '.' ident equal set_expr_or_default
           {
             Lex_ident_sys tmp(thd, &$1);
-            if (unlikely(Lex->set_system_variable(thd, Lex->option_type, &tmp, &$3, $5)))
+            if (unlikely(!tmp.str) ||
+                unlikely(Lex->set_system_variable(thd, Lex->option_type, &tmp, &$3, $5)))
               MYSQL_YYABORT;
           }
         | DEFAULT '.' ident equal set_expr_or_default
@@ -16203,7 +16205,8 @@ option_value_following_option_type:
           set_expr_or_default
           {
             Lex_ident_sys tmp(thd, &$1);
-            if (unlikely(Lex->set_system_variable(Lex->option_type, &tmp, $4)) ||
+            if (unlikely(!tmp.str) ||
+                unlikely(Lex->set_system_variable(Lex->option_type, &tmp, $4)) ||
                 unlikely(sp_create_assignment_instr(thd, yychar == YYEMPTY)))
               MYSQL_YYABORT;
           }
@@ -16215,7 +16218,8 @@ option_value_following_option_type:
           set_expr_or_default
           {
             Lex_ident_sys tmp(thd, &$1);
-            if (unlikely(Lex->set_system_variable(thd, Lex->option_type, &tmp, &$3, $6)) ||
+            if (unlikely(!tmp.str) ||
+                unlikely(Lex->set_system_variable(thd, Lex->option_type, &tmp, &$3, $6)) ||
                 unlikely(sp_create_assignment_instr(thd, yychar == YYEMPTY)))
               MYSQL_YYABORT;
           }
@@ -16242,7 +16246,8 @@ option_value_no_option_type:
           set_expr_or_default
           {
             Lex_ident_sys tmp(thd, &$1);
-            if (unlikely(Lex->set_variable(&tmp, $4)) ||
+            if (unlikely(!tmp.str) ||
+                unlikely(Lex->set_variable(&tmp, $4)) ||
                 unlikely(sp_create_assignment_instr(thd, yychar == YYEMPTY)))
               MYSQL_YYABORT;
           }
@@ -16254,7 +16259,8 @@ option_value_no_option_type:
           set_expr_or_default
           {
             Lex_ident_sys tmp(thd, &$1);
-            if (unlikely(Lex->set_variable(&tmp, &$3, $6)) ||
+            if (unlikely(!tmp.str) ||
+                unlikely(Lex->set_variable(&tmp, &$3, $6)) ||
                 unlikely(sp_create_assignment_instr(thd, yychar == YYEMPTY)))
               MYSQL_YYABORT;
           }
@@ -16422,7 +16428,8 @@ option_value_no_option_type:
           set_expr_or_default
           {
             Lex_ident_sys tmp(thd, &$1);
-            if (unlikely(Lex->set_variable(&tmp, $4)) ||
+            if (unlikely(!tmp.str) ||
+                unlikely(Lex->set_variable(&tmp, $4)) ||
                 unlikely(sp_create_assignment_instr(thd, yychar == YYEMPTY)))
               MYSQL_YYABORT;
           }
@@ -18150,14 +18157,16 @@ sp_statement:
           {
             // Direct procedure call (without the CALL keyword)
             Lex_ident_sys tmp(thd, &$1);
-            if (unlikely(Lex->call_statement_start(thd, &tmp)))
+            if (unlikely(!tmp.str) ||
+                unlikely(Lex->call_statement_start(thd, &tmp)))
               MYSQL_YYABORT;
           }
           opt_sp_cparam_list
         | ident_cli_directly_assignable '.' ident
           {
             Lex_ident_sys tmp(thd, &$1);
-            if (unlikely(Lex->call_statement_start(thd, &tmp, &$3)))
+            if (unlikely(!tmp.str) ||
+                unlikely(Lex->call_statement_start(thd, &tmp, &$3)))
               MYSQL_YYABORT;
           }
           opt_sp_cparam_list
@@ -18371,7 +18380,8 @@ set_assign:
           set_expr_or_default
           {
             Lex_ident_sys tmp(thd, &$1);
-            if (unlikely(Lex->set_variable(&tmp, $4)) ||
+            if (unlikely(!tmp.str) ||
+                unlikely(Lex->set_variable(&tmp, $4)) ||
                 unlikely(sp_create_assignment_instr(thd, yychar == YYEMPTY,
                                                     false)))
               MYSQL_YYABORT;
@@ -18388,7 +18398,8 @@ set_assign:
             LEX *lex= Lex;
             DBUG_ASSERT(lex->var_list.is_empty());
             Lex_ident_sys tmp(thd, &$1);
-            if (unlikely(lex->set_variable(&tmp, &$3, $6)) ||
+            if (unlikely(!tmp.str) ||
+                unlikely(lex->set_variable(&tmp, &$3, $6)) ||
                 unlikely(sp_create_assignment_instr(thd, yychar == YYEMPTY,
                                                     false)))
               MYSQL_YYABORT;