bug#4441 - crash in UNHEX(NULL)

mysql-test/r/func_str.result

@@ -192,9 +192,9 @@ length(quote(concat(char(0),"test")))
 select hex(quote(concat(char(224),char(227),char(230),char(231),char(232),char(234),char(235))));
 hex(quote(concat(char(224),char(227),char(230),char(231),char(232),char(234),char(235))))
 27E0E3E6E7E8EAEB27
-select unhex(hex("foobar")), hex(unhex("1234567890ABCDEF")), unhex("345678");
-unhex(hex("foobar"))	hex(unhex("1234567890ABCDEF"))	unhex("345678")
-foobar	1234567890ABCDEF	4Vx
+select unhex(hex("foobar")), hex(unhex("1234567890ABCDEF")), unhex("345678"), unhex(NULL);
+unhex(hex("foobar"))	hex(unhex("1234567890ABCDEF"))	unhex("345678")	unhex(NULL)
+foobar	1234567890ABCDEF	4Vx	NULL
 select hex(unhex("1")), hex(unhex("12")), hex(unhex("123")), hex(unhex("1234")), hex(unhex("12345")), hex(unhex("123456"));
 hex(unhex("1"))	hex(unhex("12"))	hex(unhex("123"))	hex(unhex("1234"))	hex(unhex("12345"))	hex(unhex("123456"))
 01	12	0123	1234	012345	123456

mysql-test/t/func_str.test

@@ -78,7 +78,7 @@ select quote(concat('abc\'', '\\cba'));
 select quote(1/0), quote('\0\Z');
 select length(quote(concat(char(0),"test")));
 select hex(quote(concat(char(224),char(227),char(230),char(231),char(232),char(234),char(235))));
-select unhex(hex("foobar")), hex(unhex("1234567890ABCDEF")), unhex("345678");
+select unhex(hex("foobar")), hex(unhex("1234567890ABCDEF")), unhex("345678"), unhex(NULL);
 select hex(unhex("1")), hex(unhex("12")), hex(unhex("123")), hex(unhex("1234")), hex(unhex("12345")), hex(unhex("123456"));
 select length(unhex(md5("abrakadabra")));
 

sql/item_strfunc.cc

@@ -2298,15 +2298,18 @@ String *Item_func_unhex::val_str(String *str)
 {
   DBUG_ASSERT(fixed == 1);
   /* Convert given hex string to a binary string */
+
   String *res= args[0]->val_str(str);
-  const char *from=res->ptr(), *end;
-  char *to;
-  int r;
   if (!res || tmp_value.alloc((1+res->length())/2))
   {
     null_value=1;
     return 0;
   }
+
+  const char *from=res->ptr(), *end;
+  char *to;
+  int r;
+
   null_value=0;
   tmp_value.length((1+res->length())/2);
   to= (char*) tmp_value.ptr();