Bug#14096619: UNABLE TO RESTORE DATABASE DUMP

Backport of fix for Bug#13581962

mysql-test/r/cast.result

@@ -477,4 +477,22 @@ WHERE CAST(a as BINARY)=x'62736D697468'
 AND CAST(a AS BINARY)=x'65736D697468';
 a
 DROP TABLE t1;
+#
+# Bug#13581962 HIGH MEMORY USAGE ATTEMPT, THEN CRASH WITH 
+# LONGTEXT, UNION, USER VARIABLE
+# Bug#14096619 UNABLE TO RESTORE DATABASE DUMP
+#
+CREATE TABLE t1 AS SELECT CONCAT(CAST(REPEAT('9', 1000) AS SIGNED)),
+CONCAT(CAST(REPEAT('9', 1000) AS UNSIGNED));
+Warnings:
+Warning	1292	Truncated incorrect INTEGER value: '99999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999'
+Warning	1292	Truncated incorrect INTEGER value: '99999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999'
+SHOW CREATE TABLE t1;
+Table	Create Table
+t1	CREATE TABLE `t1` (
+  `CONCAT(CAST(REPEAT('9', 1000) AS SIGNED))` varchar(21) NOT NULL DEFAULT '',
+  `CONCAT(CAST(REPEAT('9', 1000) AS UNSIGNED))` varchar(21) NOT NULL DEFAULT ''
+) ENGINE=MyISAM DEFAULT CHARSET=latin1
+DROP TABLE t1;
+# End of test for Bug#13581962, Bug#14096619
 End of 5.1 tests

mysql-test/r/ctype_utf8mb4.result

@@ -2539,6 +2539,24 @@ t2	CREATE TABLE `t2` (
 ) ENGINE=MyISAM DEFAULT CHARSET=latin1
 DROP TABLE t1, t2;
 #
+# Bug#13581962 HIGH MEMORY USAGE ATTEMPT, THEN CRASH WITH 
+# LONGTEXT, UNION, USER VARIABLE
+# Bug#14096619 UNABLE TO RESTORE DATABASE DUMP
+#
+CREATE TABLE t1(f1 LONGTEXT CHARACTER SET utf8mb4);
+INSERT INTO t1 VALUES ('a');
+SELECT @a:= CAST(f1 AS SIGNED) FROM t1
+UNION ALL
+SELECT CAST(f1 AS SIGNED) FROM t1;
+@a:= CAST(f1 AS SIGNED)
+0
+0
+Warnings:
+Warning	1292	Truncated incorrect INTEGER value: 'a'
+Warning	1292	Truncated incorrect INTEGER value: 'a'
+DROP TABLE t1;
+# End of test for Bug#13581962,Bug#14096619
+#
 # End of 5.5 tests
 #
 #

mysql-test/t/cast.test

@@ -307,4 +307,17 @@ WHERE CAST(a as BINARY)=x'62736D697468'
 
 DROP TABLE t1;
 
+--echo #
+--echo # Bug#13581962 HIGH MEMORY USAGE ATTEMPT, THEN CRASH WITH 
+--echo # LONGTEXT, UNION, USER VARIABLE
+--echo # Bug#14096619 UNABLE TO RESTORE DATABASE DUMP
+--echo #
+
+CREATE TABLE t1 AS SELECT CONCAT(CAST(REPEAT('9', 1000) AS SIGNED)),
+                          CONCAT(CAST(REPEAT('9', 1000) AS UNSIGNED));
+SHOW CREATE TABLE t1;
+DROP TABLE t1;
+
+--echo # End of test for Bug#13581962, Bug#14096619
+
 --echo End of 5.1 tests

mysql-test/t/ctype_utf8mb4.test

@@ -1811,6 +1811,21 @@ CREATE TABLE t2 AS SELECT CONCAT(s1) FROM t1;
 SHOW CREATE TABLE t2;
 DROP TABLE t1, t2;
 
+--echo #
+--echo # Bug#13581962 HIGH MEMORY USAGE ATTEMPT, THEN CRASH WITH 
+--echo # LONGTEXT, UNION, USER VARIABLE
+--echo # Bug#14096619 UNABLE TO RESTORE DATABASE DUMP
+--echo #
+
+CREATE TABLE t1(f1 LONGTEXT CHARACTER SET utf8mb4);
+INSERT INTO t1 VALUES ('a');
+SELECT @a:= CAST(f1 AS SIGNED) FROM t1
+UNION ALL
+SELECT CAST(f1 AS SIGNED) FROM t1;
+DROP TABLE t1;
+
+--echo # End of test for Bug#13581962,Bug#14096619
+
 --echo #
 --echo # End of 5.5 tests
 --echo #

sql/item_func.h

@@ -480,12 +480,18 @@ public:
 class Item_func_signed :public Item_int_func
 {
 public:
-  Item_func_signed(Item *a) :Item_int_func(a) {}
+  Item_func_signed(Item *a) :Item_int_func(a)
+  {
+    unsigned_flag= 0;
+  }
   const char *func_name() const { return "cast_as_signed"; }
   longlong val_int();
   longlong val_int_from_str(int *error);
   void fix_length_and_dec()
-  { fix_char_length(args[0]->max_char_length()); unsigned_flag=0; }
+  {
+    fix_char_length(min(args[0]->max_char_length(),
+                        MY_INT64_NUM_DECIMAL_DIGITS));
+  }
   virtual void print(String *str, enum_query_type query_type);
   uint decimal_precision() const { return args[0]->decimal_precision(); }
 };
@@ -494,14 +500,11 @@ public:
 class Item_func_unsigned :public Item_func_signed
 {
 public:
-  Item_func_unsigned(Item *a) :Item_func_signed(a) {}
-  const char *func_name() const { return "cast_as_unsigned"; }
-  void fix_length_and_dec()
+  Item_func_unsigned(Item *a) :Item_func_signed(a)
   {
-    fix_char_length(min(args[0]->max_char_length(),
-                        DECIMAL_MAX_PRECISION + 2));
-    unsigned_flag=1;
+    unsigned_flag= 1;
   }
+  const char *func_name() const { return "cast_as_unsigned"; }
   longlong val_int();
   virtual void print(String *str, enum_query_type query_type);
 };