From e2a546aef46834b8250b3129ee87e944b4dd6ccb Mon Sep 17 00:00:00 2001
From: Gleb Shchepa <gshchepa@mysql.com>
Date: Sat, 3 Apr 2010 00:30:22 +0400
Subject: [PATCH] Bug #40625: Concat fails on DOUBLE values in a Stored        
     Procedure, while DECIMAL works

Selecting of the CONCAT(...<SP variable>...) result into
a user variable may return wrong data.


Item_func_concat::val_str contains a number of memory
allocation-saving tricks. One of them concatenates
strings inplace inserting the value of one string
at the beginning of the other string. However,
this trick didn't care about strings those points
to the same data buffer: this is possible when
a CONCAT() parameter is a stored procedure variable -
Item_sp_variable::val_str() uses the intermediate
Item_sp_variable::str_value field, where it may
store a reference to an external buffer.


The Item_func_concat::val_str function has been
modified to take into account val_str functions
(such as Item_sp_variable::val_str) that return
a pointer to an internal Item member variable
that may reference to a buffer provided.


mysql-test/r/func_concat.result:
  Test case for the bug #40625.
mysql-test/t/func_concat.test:
  Test case for the bug #40625.
sql/item_strfunc.cc:
  Bug #40625: Concat fails on DOUBLE values in a Stored
              Procedure, while DECIMAL works

  The Item_func_concat::val_str function has been
  modified to take into account val_str functions
  (such as Item_sp_variable::val_str) that return
  a pointer to an internal Item member variable
  that may reference to a buffer provided.
---
 mysql-test/r/func_concat.result | 18 ++++++++++++++++++
 mysql-test/t/func_concat.test   | 20 ++++++++++++++++++++
 sql/item_strfunc.cc             |  2 +-
 3 files changed, 39 insertions(+), 1 deletion(-)

diff --git a/mysql-test/r/func_concat.result b/mysql-test/r/func_concat.result
index c4c2b46c6c2..fae8979a6e7 100644
--- a/mysql-test/r/func_concat.result
+++ b/mysql-test/r/func_concat.result
@@ -130,4 +130,22 @@ SELECT @query;
 @query
 abcde,0,1234
 DROP PROCEDURE p1;
+#
+# Bug #40625: Concat fails on DOUBLE values in a Stored Procedure,
+#             while DECIMAL works
+#
+CREATE PROCEDURE p1()
+BEGIN
+DECLARE v1 DOUBLE(10,3);
+SET v1= 100;
+SET @s = CONCAT('########################################', 40 , v1);
+SELECT @s;
+END;//
+CALL p1();
+@s
+########################################40100.000
+CALL p1();
+@s
+########################################40100.000
+DROP PROCEDURE p1;
 # End of 5.1 tests
diff --git a/mysql-test/t/func_concat.test b/mysql-test/t/func_concat.test
index e24b4354b61..e56d1121808 100644
--- a/mysql-test/t/func_concat.test
+++ b/mysql-test/t/func_concat.test
@@ -124,4 +124,24 @@ SELECT @query;
 
 DROP PROCEDURE p1;
 
+--echo #
+--echo # Bug #40625: Concat fails on DOUBLE values in a Stored Procedure,
+--echo #             while DECIMAL works
+--echo #
+
+DELIMITER //;
+CREATE PROCEDURE p1()
+BEGIN
+  DECLARE v1 DOUBLE(10,3);
+  SET v1= 100;
+  SET @s = CONCAT('########################################', 40 , v1);
+  SELECT @s;
+END;//
+DELIMITER ;//
+
+CALL p1();
+CALL p1();
+
+DROP PROCEDURE p1;
+
 --echo # End of 5.1 tests
diff --git a/sql/item_strfunc.cc b/sql/item_strfunc.cc
index 66308215d0b..b53172d631a 100644
--- a/sql/item_strfunc.cc
+++ b/sql/item_strfunc.cc
@@ -324,7 +324,7 @@ String *Item_func_concat::val_str(String *str)
       }
       else if (str->alloced_length() >= res->length()+res2->length())
       {
-	if (str == res2)
+	if (str->ptr() == res2->ptr())
 	  str->replace(0,0,*res);
 	else
 	{