Fixed bug#20503: Server crash due to the ORDER clause not taken into account

while space allocation

Under some circumstances DISTINCT clause can be converted to grouping.
In such cases grouping is performed by all items in the select list.
If an ORDER clause is present then items from it is prepended to group list.
But the case with ORDER wasn't taken into account when allocating the
array for sum functions. This leads to memory corruption and crash.

The JOIN::alloc_func_list() function now allocates additional space if there
is an ORDER by clause is specified and DISTINCT -> GROUP BY optimization is
possible.

mysql-test/r/select.result

@@ -3517,3 +3517,9 @@ id	a	b	c	d	e
 2	NULL	NULL	NULL	2	40
 2	NULL	NULL	NULL	2	50
 DROP TABLE t1,t2,t3;
+create table t1 (c1 varchar(1), c2 int, c3 int, c4 int, c5 int, c6 int,
+c7 int, c8 int, c9 int, fulltext key (`c1`));
+select distinct match (`c1`) against ('z') , c2, c3, c4,c5, c6,c7, c8 
+from t1 where c9=1 order by c2, c2;
+match (`c1`) against ('z')	c2	c3	c4	c5	c6	c7	c8
+drop table t1;

mysql-test/t/select.test

@@ -2996,5 +2996,14 @@ SELECT * FROM t1 LEFT JOIN t2 ON t2.b=t1.a INNER JOIN t3 ON t3.d=t1.id
 SELECT * FROM t1 LEFT JOIN t2 ON t2.b=t1.a INNER JOIN t3 ON t3.d=t1.id
   WHERE t1.id=2;
 
-
 DROP TABLE t1,t2,t3;
+
+#
+# Bug#20503: Server crash due to the ORDER clause isn't taken into account
+#            while space allocation
+#
+create table t1 (c1 varchar(1), c2 int, c3 int, c4 int, c5 int, c6 int,
+c7 int, c8 int, c9 int, fulltext key (`c1`));
+select distinct match (`c1`) against ('z') , c2, c3, c4,c5, c6,c7, c8 
+  from t1 where c9=1 order by c2, c2;
+drop table t1;

sql/sql_select.cc

@@ -13515,7 +13515,19 @@ bool JOIN::alloc_func_list()
     disctinct->group_by optimization
   */
   if (select_distinct)
+  {
     group_parts+= fields_list.elements;
+    /*
+      If the ORDER clause is specified then it's possible that
+      it also will be optimized, so reserve space for it too
+    */
+    if (order)
+    {
+      ORDER *ord;
+      for (ord= order; ord; ord= ord->next)
+        group_parts++;
+    }
+  }
 
   /* This must use calloc() as rollup_make_fields depends on this */
   sum_funcs= (Item_sum**) thd->calloc(sizeof(Item_sum**) * (func_count+1) +