A fix for the bug #7495

mysql-test/r/func_str.result

@@ -291,3 +291,15 @@ trim(trailing 'foo' from 'foo')
 select trim(leading 'foo' from 'foo');
 trim(leading 'foo' from 'foo')
 
+create table t1 (a varchar(80), b varchar(80));
+insert into t1 values(NULL,"12345");
+insert into t1 values(NULL,"chm");
+select quote(ltrim(concat('  ',t1.b))) from t1;
+quote(ltrim(concat('  ',t1.b)))
+'12345'
+'chm'
+select quote(trim(concat('  ',t1.b))) from t1;
+quote(trim(concat('  ',t1.b)))
+'12345'
+'chm'
+drop table t1;

mysql-test/t/func_str.test

@@ -185,3 +185,15 @@ drop table t1;
 
 select trim(trailing 'foo' from 'foo');
 select trim(leading 'foo' from 'foo');
+
+#
+# crashing bug with QUOTE() and LTRIM() or TRIM() fixed
+# Bug #7495
+#
+
+create table t1 (a varchar(80), b varchar(80));
+insert into t1 values(NULL,"12345");
+insert into t1 values(NULL,"chm");
+select quote(ltrim(concat('  ',t1.b))) from t1;
+select quote(trim(concat('  ',t1.b))) from t1;
+drop table t1;

sql/item_strfunc.cc

@@ -1141,7 +1141,7 @@ String *Item_func_ltrim::val_str(String *str)
   }
   if (ptr == res->ptr())
     return res;
-  tmp_value.set(*res,(uint) (ptr - res->ptr()),(uint) (end-ptr));
+  tmp_value.copy(res->ptr() + (ptr - res->ptr()), (uint32) (end - ptr));
   return &tmp_value;
 }
 
@@ -1266,7 +1266,7 @@ String *Item_func_trim::val_str(String *str)
   }
   if (ptr == res->ptr() && end == ptr+res->length())
     return res;
-  tmp_value.set(*res,(uint) (ptr - res->ptr()),(uint) (end-ptr));
+  tmp_value.copy(res->ptr() + (ptr - res->ptr()), (uint32) (end - ptr));
   return &tmp_value;
 }