bug#35558 Wrong server metadata blows up the client

the problem: FORMAT func max_length value was calculated incorrectly
the fix: correct calculation of max_length

mysql-test/r/func_str.result

@@ -717,8 +717,6 @@ insert(_latin2'abcd',2,3,_latin2'ef'),
 replace(_latin2'abcd',_latin2'b',_latin2'B'),
 encode('abcd','ab')
 ;
-Warnings:
-Warning	1265	Data truncated for column 'format(130,10)' at row 1
 show create table t1;
 Table	Create Table
 t1	CREATE TABLE `t1` (
@@ -727,7 +725,7 @@ t1	CREATE TABLE `t1` (
   `conv(130,16,10)` varchar(64) default NULL,
   `hex(130)` varchar(6) NOT NULL default '',
   `char(130)` varbinary(4) NOT NULL default '',
-  `format(130,10)` varchar(4) NOT NULL default '',
+  `format(130,10)` varchar(16) NOT NULL default '',
   `left(_latin2'a',1)` varchar(1) character set latin2 NOT NULL default '',
   `right(_latin2'a',1)` varchar(1) character set latin2 NOT NULL default '',
   `lcase(_latin2'a')` varchar(1) character set latin2 NOT NULL default '',
@@ -2175,4 +2173,12 @@ SELECT HEX(c1) from v1;
 HEX(c1)
 414243
 DROP VIEW v1;
+create table t1(a float);
+insert into t1 values (1.33);
+select format(a, 2) from t1;
+Catalog	Database	Table	Table_alias	Column	Column_alias	Type	Length	Max length	Is_null	Flags	Decimals	Charsetnr
+def					format(a, 2)	253	20	4	Y	0	2	8
+format(a, 2)
+1.33
+drop table t1;
 End of 5.0 tests

mysql-test/t/func_str.test

@@ -1149,4 +1149,14 @@ CREATE VIEW v1 AS SELECT CHAR(0x414243) as c1;
 SELECT HEX(c1) from v1;
 DROP VIEW v1;
 
+#
+# Bug #35558 Wrong server metadata blows up the client
+#
+create table t1(a float);
+insert into t1 values (1.33);
+--enable_metadata
+select format(a, 2) from t1;
+--disable_metadata
+drop table t1;
+
 --echo End of 5.0 tests

sql/item_strfunc.h

@@ -516,8 +516,9 @@ class Item_func_format :public Item_str_func
   {
     collation.set(default_charset());
     uint char_length= args[0]->max_length/args[0]->collation.collation->mbmaxlen;
-    max_length= ((char_length + (char_length-args[0]->decimals)/3) *
-                 collation.collation->mbmaxlen);
+    uint max_sep_count= char_length/3 + (decimals ? 1 : 0) + /*sign*/1;
+    max_length= (char_length + max_sep_count + decimals) *
+      collation.collation->mbmaxlen;
   }
   const char *func_name() const { return "format"; }
   void print(String *);