Manually merged

mysql-test/r/update.result

@@ -358,3 +358,7 @@ update t2,t1 set f1=3,f2=3 where f1=f2 and f1=1;
 affected rows: 3
 info: Rows matched: 3  Changed: 3  Warnings: 0
 drop table t1,t2;
+create table t1(f1 int, `*f2` int);
+insert into t1 values (1,1);
+update t1 set `*f2`=1;
+drop table t1;

mysql-test/t/update.test

@@ -287,4 +287,12 @@ update t1 set f1=1 where f1=3;
 update t2,t1 set f1=3,f2=3 where f1=f2 and f1=1;
 --disable_info
 drop table t1,t2;
+
+#
+# Bug #16510 Updating field named like '*name' caused server crash
+#
+create table t1(f1 int, `*f2` int);
+insert into t1 values (1,1);
+update t1 set `*f2`=1;
+drop table t1;
 # End of 4.1 tests

sql/sql_base.cc

@@ -2390,6 +2390,7 @@ int setup_wild(THD *thd, TABLE_LIST *tables, List<Item> &fields,
     if (item->type() == Item::FIELD_ITEM &&
         ((Item_field*) item)->field_name &&
 	((Item_field*) item)->field_name[0] == '*' &&
+        ((Item_field*) item)->field_name[1] == 0 &&
 	!((Item_field*) item)->field)
     {
       uint elem= fields.elements;