MDEV-729 lp:998028 - Server crashes on normal shutdown in closefrm after...

MDEV-729 lp:998028 - Server crashes on normal shutdown in closefrm after executing a query from MyISAM table

don't write a key value into the record buffer - a key length can be larger then the record length.

mysql-test/r/group_min_max.result

@@ -2780,4 +2780,11 @@ ORDER BY min_a;
 min_a
 NULL
 DROP TABLE t1;
+create table t1 (a int, b varchar(1), key(b,a)) engine=myisam;
+insert t1 values (1,'a'),(2,'b'),(3,'c'),(4,'d'),(5,'e'),(6,'f'),(7,'g'),(8,'h'),(null,'i');
+select min(a), b from t1 where a=7 or b='z' group by b;
+min(a)	b
+7	g
+flush tables;
+drop table t1;
 End of 5.1 tests

mysql-test/t/group_min_max.test

@@ -1099,5 +1099,13 @@ ORDER BY min_a;
 
 DROP TABLE t1;
 
+#
+# MDEV-729 lp:998028 - Server crashes on normal shutdown in closefrm after executing a query from MyISAM table
+#
+create table t1 (a int, b varchar(1), key(b,a)) engine=myisam;
+insert t1 values (1,'a'),(2,'b'),(3,'c'),(4,'d'),(5,'e'),(6,'f'),(7,'g'),(8,'h'),(null,'i');
+select min(a), b from t1 where a=7 or b='z' group by b;
+flush tables;
+drop table t1;
 
 --echo End of 5.1 tests

sql/opt_range.cc

@@ -10815,9 +10815,10 @@ int QUICK_GROUP_MIN_MAX_SELECT::next_min()
     */
     if (min_max_arg_part && min_max_arg_part->field->is_null())
     {
+      uchar *tmp_key_buff= (uchar*)my_alloca(index_info->key_length);
       /* Find the first subsequent record without NULL in the MIN/MAX field. */
-      key_copy(tmp_record, record, index_info, 0);
-      result= file->index_read_map(record, tmp_record,
+      key_copy(tmp_key_buff, record, index_info, 0);
+      result= file->index_read_map(record, tmp_key_buff,
                                    make_keypart_map(real_key_parts),
                                    HA_READ_AFTER_KEY);
       /*
@@ -10833,10 +10834,11 @@ int QUICK_GROUP_MIN_MAX_SELECT::next_min()
       if (!result)
       {
         if (key_cmp(index_info->key_part, group_prefix, real_prefix_len))
-          key_restore(record, tmp_record, index_info, 0);
+          key_restore(record, tmp_key_buff, index_info, 0);
       }
       else if (result == HA_ERR_KEY_NOT_FOUND || result == HA_ERR_END_OF_FILE)
         result= 0; /* There is a result in any case. */
+      my_afree(tmp_key_buff);
     }
   }