Fix for #739

check for negative count in RPAD added

mysql-test/r/func_str.result

@@ -247,3 +247,13 @@ elt(status_wnio,data_podp)
 NULL
 NULL
 DROP TABLE t1;
+CREATE TABLE t1 (
+title text
+) TYPE=MyISAM;
+INSERT INTO t1 VALUES ('Congress reconvenes in September to debate welfare and adult education');
+INSERT INTO t1 VALUES ('House passes the CAREERS bill');
+SELECT CONCAT("</a>",RPAD("",(55 - LENGTH(title)),".")) from t1;
+CONCAT("</a>",RPAD("",(55 - LENGTH(title)),"."))
+NULL
+</a>..........................
+DROP TABLE t1;

mysql-test/t/func_str.test

@@ -137,3 +137,17 @@ INSERT INTO t1 VALUES (8,NULL,'real');
 INSERT INTO t1 VALUES (9,NULL,'nowy');
 SELECT elt(status_wnio,data_podp) FROM t1 GROUP BY wid;
 DROP TABLE t1;
+
+#
+# test for #739
+
+CREATE TABLE t1 (
+  title text
+) TYPE=MyISAM;
+
+INSERT INTO t1 VALUES ('Congress reconvenes in September to debate welfare and adult education');
+INSERT INTO t1 VALUES ('House passes the CAREERS bill');
+
+SELECT CONCAT("</a>",RPAD("",(55 - LENGTH(title)),".")) from t1;
+
+DROP TABLE t1;

sql/item_strfunc.cc

@@ -1804,7 +1804,7 @@ String *Item_func_rpad::val_str(String *str)
   String *res =args[0]->val_str(str);
   String *rpad = args[2]->val_str(str);
 
-  if (!res || args[1]->null_value || !rpad)
+  if (!res || args[1]->null_value || !rpad || count < 0)
     goto err;
   null_value=0;
   if (count <= (int32) (res_length=res->length()))