From 4df18b1aaebc408c1f60a8c155121d7350e28c94 Mon Sep 17 00:00:00 2001
From: "igor@rurik.mysql.com" <>
Date: Thu, 4 Nov 2004 20:39:52 -0800
Subject: [PATCH] func_in.result, func_in.test:   Added a case for bug #6365.
 item_cmpfunc.cc:   Fixed bug #6365 : Server crashed when list of values   in
 IN predicate contains NULL while the tested field is   of the character type
 and not of the default set;   e.g. when f in 'f IN (NULL,'aa') belongs to
 binary   character set, while the default character set is latin1.

---
 mysql-test/r/func_in.result | 6 ++++++
 mysql-test/t/func_in.test   | 7 +++++++
 sql/item_cmpfunc.cc         | 3 ++-
 3 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/mysql-test/r/func_in.result b/mysql-test/r/func_in.result
index 374affce8c5..daeda51a12a 100644
--- a/mysql-test/r/func_in.result
+++ b/mysql-test/r/func_in.result
@@ -179,3 +179,9 @@ select 1 in ('1.1',2);
 select 1 in ('1.1',2.0);
 1 in ('1.1',2.0)
 0
+create table t1 (a char(20) character set binary);
+insert into t1 values ('aa'), ('bb');
+select * from t1 where a in (NULL, 'aa');
+a
+aa
+drop table t1;
diff --git a/mysql-test/t/func_in.test b/mysql-test/t/func_in.test
index 22079377ad2..3cd8c064817 100644
--- a/mysql-test/t/func_in.test
+++ b/mysql-test/t/func_in.test
@@ -89,3 +89,10 @@ select 1 in ('1.0',2.0);
 select 1 in (1.0,'2.0');
 select 1 in ('1.1',2);
 select 1 in ('1.1',2.0);
+
+# Test case for bug #6365
+
+create table t1 (a char(20) character set binary);
+insert into t1 values ('aa'), ('bb');
+select * from t1 where a in (NULL, 'aa');
+drop table t1;
diff --git a/sql/item_cmpfunc.cc b/sql/item_cmpfunc.cc
index 701894cacb5..a28f0f5d4a9 100644
--- a/sql/item_cmpfunc.cc
+++ b/sql/item_cmpfunc.cc
@@ -1749,7 +1749,8 @@ void Item_func_in::fix_length_and_dec()
         thd->set_n_backup_item_arena(arena, &backup);
       for (arg= args+1, arg_end= args+arg_count; arg < arg_end; arg++)
       {
-        if (!my_charset_same(cmp_collation.collation,
+        if (!arg[0]->null_value &&
+            !my_charset_same(cmp_collation.collation,
                              arg[0]->collation.collation))
         {
           Item_string *conv;