fixed double-free bug in COM_CHANGE_USER

sql/sql_parse.cc

@@ -793,6 +793,7 @@ bool do_command(THD *thd)
     char *save_user=	    thd->user;
     char *save_priv_user=   thd->priv_user;
     char *save_db=	    thd->db;
+    thd->user=0;
 
     if ((uint) ((uchar*) db - net->read_pos) > packet_length)
     {						// Check if protocol is ok
@@ -802,7 +803,6 @@ bool do_command(THD *thd)
     if (check_user(thd, COM_CHANGE_USER, user, passwd, db, 0))
     {						// Restore old user
       x_free(thd->user);
-      x_free(thd->db);
       thd->master_access=save_master_access;
       thd->db_access=save_db_access;
       thd->db=save_db;