merged 5.0-bugteam -> 5.1-bugteam

sql/opt_range.cc

@@ -2243,7 +2243,7 @@ int SQL_SELECT::test_quick_select(THD *thd, key_map keys_to_use,
     KEY *key_info;
     PARAM param;
 
-    if (check_stack_overrun(thd, 2*STACK_MIN_SIZE, buff))
+    if (check_stack_overrun(thd, 2*STACK_MIN_SIZE + sizeof(PARAM), buff))
       DBUG_RETURN(0);                           // Fatal error flag is set
 
     /* set up parameter that is passed to all functions */
@@ -9795,11 +9795,22 @@ get_constant_key_infix(KEY *index_info, SEL_ARG *index_range_tree,
       return FALSE;
 
     uint field_length= cur_part->store_length;
-    if ((cur_range->maybe_null &&
-         cur_range->min_value[0] && cur_range->max_value[0]) ||
-        !memcmp(cur_range->min_value, cur_range->max_value, field_length))
-    {
-      /* cur_range specifies 'IS NULL' or an equality condition. */
+    if (cur_range->maybe_null &&
+         cur_range->min_value[0] && cur_range->max_value[0])
+    { 
+      /*
+        cur_range specifies 'IS NULL'. In this case the argument points
+        to a "null value" (is_null_string) that may not always be long
+        enough for a direct memcpy to a field.
+      */
+      DBUG_ASSERT (field_length > 0);
+      *key_ptr= 1;
+      bzero(key_ptr+1,field_length-1);
+      key_ptr+= field_length;
+      *key_infix_len+= field_length;
+    }
+    else if (memcmp(cur_range->min_value, cur_range->max_value, field_length) == 0)
+    { /* cur_range specifies an equality condition. */
       memcpy(key_ptr, cur_range->min_value, field_length);
       key_ptr+= field_length;
       *key_infix_len+= field_length;