Merge abotchkov@bk-internal.mysql.com:/home/bk/mysql-4.0

into deer.(none):/home/hf/work/mysql-4.0.628

mysql-test/r/func_misc.result

@@ -13,3 +13,6 @@ NULL	255.255.1.255	0.0.1.255
 select length(format('nan', 2)) > 0;
 length(format('nan', 2)) > 0
 1
+select concat("$",format(2500,2));
+concat("$",format(2500,2))
+$2,500.00

mysql-test/t/func_misc.test

@@ -12,3 +12,8 @@ select inet_ntoa(1099511627775),inet_ntoa(4294902271),inet_ntoa(511);
 # Test for core dump with nan
 #
 select length(format('nan', 2)) > 0;
+
+#
+# Test for bug #628
+#
+select concat("$",format(2500,2));

sql/item_strfunc.cc

@@ -1483,7 +1483,7 @@ String *Item_func_format::val_str(String *str)
     str= copy_if_not_alloced(&tmp_str,str,length);
     str->length(length);
     tmp= (char*) str->ptr()+length - dec-1;
-    for (pos= (char*) str->ptr()+length ; pos != tmp; pos--)
+    for (pos= (char*) str->ptr()+length-1; pos != tmp; pos--)
       pos[0]= pos[-(int) diff];
     while (diff)
     {