1 /*
2    Copyright (c) 2000, 2017, Oracle and/or its affiliates.
3    Copyright (c) 2009, 2020, MariaDB Corporation.
4 
5    This program is free software; you can redistribute it and/or modify
6    it under the terms of the GNU General Public License as published by
7    the Free Software Foundation; version 2 of the License.
8 
9    This program is distributed in the hope that it will be useful,
10    but WITHOUT ANY WARRANTY; without even the implied warranty of
11    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
12    GNU General Public License for more details.
13 
14    You should have received a copy of the GNU General Public License
15    along with this program; if not, write to the Free Software
16    Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1335  USA
17 */
18 
19 /**
20   @file
21 
22   @brief
23   This file defines all string functions
24 
25   @warning
26     Some string functions don't always put and end-null on a String.
27     (This shouldn't be needed)
28 */
29 
30 #ifdef USE_PRAGMA_IMPLEMENTATION
31 #pragma implementation				// gcc: Class implementation
32 #endif
33 
34 #include "mariadb.h"                          // HAVE_*
35 
36 #include "sql_priv.h"
37 /*
38   It is necessary to include set_var.h instead of item.h because there
39   are dependencies on include order for set_var.h and item.h. This
40   will be resolved later.
41 */
42 #include "sql_class.h"                          // set_var.h: THD
43 #include "set_var.h"
44 #include "sql_base.h"
45 #include "sql_time.h"
46 #include "sql_acl.h"                            // SUPER_ACL
47 #include "des_key_file.h"       // st_des_keyschedule, st_des_keyblock
48 #include "password.h"           // my_make_scrambled_password,
49                                 // my_make_scrambled_password_323
50 #include <m_ctype.h>
51 #include <my_md5.h>
52 C_MODE_START
53 #include "../mysys/my_static.h"			// For soundex_map
54 C_MODE_END
55 #include "sql_show.h"                           // append_identifier
56 #include <sql_repl.h>
57 #include "sql_statistics.h"
58 
59 size_t username_char_length= 80;
60 
61 
62 class Repeat_count
63 {
64   ulonglong m_count;
65 public:
66   Repeat_count(Item *item)
67    :m_count(0)
68   {
69     Longlong_hybrid nr= item->to_longlong_hybrid();
70     if (!item->null_value && !nr.neg())
71     {
72       // Assume that the maximum length of a String is < INT_MAX32
73       m_count= (ulonglong) nr.value();
74       if (m_count > (ulonglong) INT_MAX32)
75         m_count= (ulonglong) INT_MAX32;
76     }
77   }
78   ulonglong count() const { return m_count; }
79 };
80 
81 
82 /*
83   For the Items which have only val_str_ascii() method
84   and don't have their own "native" val_str(),
85   we provide a "wrapper" method to convert from ASCII
86   to Item character set when it's necessary.
87   Conversion happens only in case of "tricky" Item character set (e.g. UCS2).
88   Normally conversion does not happen, and val_str_ascii() is immediately
89   returned instead.
90 
91   No matter if conversion is needed or not needed,
92   the result is always returned in "str" (see MDEV-10306 why).
93 
94   @param [OUT] str          - Store the result here
95   @param [IN]  ascii_buffer - Use this temporary buffer to call val_str_ascii()
96 */
97 String *Item_func::val_str_from_val_str_ascii(String *str, String *ascii_buffer)
98 {
99   DBUG_ASSERT(fixed == 1);
100 
101   if (!(collation.collation->state & MY_CS_NONASCII))
102   {
103     String *res= val_str_ascii(str);
104     if (res)
105       res->set_charset(collation.collation);
106     return res;
107   }
108 
109   DBUG_ASSERT(str != ascii_buffer);
110 
111   uint errors;
112   String *res= val_str_ascii(ascii_buffer);
113   if (!res)
114     return 0;
115 
116   if ((null_value= str->copy(res->ptr(), res->length(),
117                              &my_charset_latin1, collation.collation,
118                              &errors)))
119     return 0;
120 
121   return str;
122 }
123 
124 
125 bool Item_str_func::fix_fields(THD *thd, Item **ref)
126 {
127   bool res= Item_func::fix_fields(thd, ref);
128   /*
129     In Item_str_func::check_well_formed_result() we may set null_value
130     flag on the same condition as in test() below.
131   */
132   maybe_null= maybe_null || thd->is_strict_mode();
133   return res;
134 }
135 
136 
137 my_decimal *Item_str_func::val_decimal(my_decimal *decimal_value)
138 {
139   DBUG_ASSERT(fixed == 1);
140   StringBuffer<64> tmp;
141   String *res= val_str(&tmp);
142   return res ? decimal_from_string_with_check(decimal_value, res) : 0;
143 }
144 
145 
146 double Item_str_func::val_real()
147 {
148   DBUG_ASSERT(fixed == 1);
149   StringBuffer<64> tmp;
150   String *res= val_str(&tmp);
151   return res ? double_from_string_with_check(res) : 0.0;
152 }
153 
154 
155 longlong Item_str_func::val_int()
156 {
157   DBUG_ASSERT(fixed == 1);
158   StringBuffer<22> tmp;
159   String *res= val_str(&tmp);
160   return res ? longlong_from_string_with_check(res) : 0;
161 }
162 
163 
164 String *Item_func_md5::val_str_ascii(String *str)
165 {
166   DBUG_ASSERT(fixed == 1);
167   String * sptr= args[0]->val_str(str);
168   if (sptr)
169   {
170     uchar digest[16];
171 
172     null_value=0;
173     compute_md5_hash(digest, (const char *) sptr->ptr(), sptr->length());
174     if (str->alloc(32))				// Ensure that memory is free
175     {
176       null_value=1;
177       return 0;
178     }
179     array_to_hex((char *) str->ptr(), digest, 16);
180     str->set_charset(&my_charset_numeric);
181     str->length((uint) 32);
182     return str;
183   }
184   null_value=1;
185   return 0;
186 }
187 
188 
189 String *Item_func_sha::val_str_ascii(String *str)
190 {
191   DBUG_ASSERT(fixed == 1);
192   String * sptr= args[0]->val_str(str);
193   if (sptr)  /* If we got value different from NULL */
194   {
195     /* Temporary buffer to store 160bit digest */
196     uint8 digest[MY_SHA1_HASH_SIZE];
197     my_sha1(digest, (const char *) sptr->ptr(), sptr->length());
198     /* Ensure that memory is free and we got result */
199     if (!str->alloc(MY_SHA1_HASH_SIZE*2))
200     {
201       array_to_hex((char *) str->ptr(), digest, MY_SHA1_HASH_SIZE);
202       str->set_charset(&my_charset_numeric);
203       str->length((uint)  MY_SHA1_HASH_SIZE*2);
204       null_value=0;
205       return str;
206     }
207   }
208   null_value=1;
209   return 0;
210 }
211 
212 bool Item_func_sha::fix_length_and_dec()
213 {
214   // size of hex representation of hash
215   fix_length_and_charset(MY_SHA1_HASH_SIZE * 2, default_charset());
216   return FALSE;
217 }
218 
219 String *Item_func_sha2::val_str_ascii(String *str)
220 {
221   DBUG_ASSERT(fixed == 1);
222   unsigned char digest_buf[512/8]; // enough for SHA512
223   String *input_string;
224   const char *input_ptr;
225   size_t input_len;
226 
227   input_string= args[0]->val_str(str);
228   str->set_charset(&my_charset_bin);
229 
230   if (input_string == NULL)
231   {
232     null_value= TRUE;
233     return (String *) NULL;
234   }
235 
236   null_value= args[0]->null_value;
237   if (null_value)
238     return (String *) NULL;
239 
240   input_ptr= input_string->ptr();
241   input_len= input_string->length();
242 
243   longlong digest_length= args[1]->val_int();
244   switch (digest_length) {
245   case 512:
246     my_sha512(digest_buf, input_ptr, input_len);
247     break;
248   case 384:
249     my_sha384(digest_buf, input_ptr, input_len);
250     break;
251   case 224:
252     my_sha224(digest_buf, input_ptr, input_len);
253     break;
254   case 0: // SHA-256 is the default
255     digest_length= 256;
256     /* fall through */
257   case 256:
258     my_sha256(digest_buf, input_ptr, input_len);
259     break;
260   default:
261     if (!args[1]->const_item())
262     {
263       THD *thd= current_thd;
264       push_warning_printf(thd,
265                           Sql_condition::WARN_LEVEL_WARN,
266                           ER_WRONG_PARAMETERS_TO_NATIVE_FCT,
267                           ER_THD(thd, ER_WRONG_PARAMETERS_TO_NATIVE_FCT),
268                           "sha2");
269     }
270     null_value= TRUE;
271     return NULL;
272   }
273   digest_length/= 8; /* bits to bytes */
274 
275   /*
276     Since we're subverting the usual String methods, we must make sure that
277     the destination has space for the bytes we're about to write.
278   */
279   str->realloc((uint) digest_length*2 + 1); /* Each byte as two nybbles */
280 
281   /* Convert the large number to a string-hex representation. */
282   array_to_hex((char *) str->ptr(), digest_buf, (uint)digest_length);
283 
284   /* We poked raw bytes in.  We must inform the the String of its length. */
285   str->length((uint) digest_length*2); /* Each byte as two nybbles */
286 
287   null_value= FALSE;
288   return str;
289 }
290 
291 
292 bool Item_func_sha2::fix_length_and_dec()
293 {
294   maybe_null= 1;
295   max_length = 0;
296 
297   int sha_variant= (int)(args[1]->const_item() ? args[1]->val_int() : 512);
298 
299   switch (sha_variant) {
300   case 0: // SHA-256 is the default
301     sha_variant= 256;
302     /* fall through */
303   case 512:
304   case 384:
305   case 256:
306   case 224:
307     fix_length_and_charset(sha_variant/8 * 2, default_charset());
308     break;
309   default:
310     THD *thd= current_thd;
311     push_warning_printf(thd,
312                         Sql_condition::WARN_LEVEL_WARN,
313                         ER_WRONG_PARAMETERS_TO_NATIVE_FCT,
314                         ER_THD(thd, ER_WRONG_PARAMETERS_TO_NATIVE_FCT),
315                         "sha2");
316   }
317   return FALSE;
318 }
319 
320 /* Implementation of AES encryption routines */
321 void Item_aes_crypt::create_key(String *user_key, uchar *real_key)
322 {
323   uchar *real_key_end= real_key + AES_KEY_LENGTH / 8;
324   uchar *ptr;
325   const char *sptr= user_key->ptr();
326   const char *key_end= sptr + user_key->length();
327 
328   bzero(real_key, AES_KEY_LENGTH / 8);
329 
330   for (ptr= real_key; sptr < key_end; ptr++, sptr++)
331   {
332     if (ptr == real_key_end)
333       ptr= real_key;
334     *ptr ^= (uchar) *sptr;
335   }
336 }
337 
338 
339 String *Item_aes_crypt::val_str(String *str2)
340 {
341   DBUG_ASSERT(fixed == 1);
342   StringBuffer<80> user_key_buf;
343   String *sptr= args[0]->val_str(&tmp_value);
344   String *user_key=  args[1]->val_str(&user_key_buf);
345   uint32 aes_length;
346 
347   if (sptr && user_key) // we need both arguments to be not NULL
348   {
349     null_value=0;
350     aes_length=my_aes_get_size(MY_AES_ECB, sptr->length());
351 
352     if (!str2->alloc(aes_length))		// Ensure that memory is free
353     {
354       uchar rkey[AES_KEY_LENGTH / 8];
355       create_key(user_key, rkey);
356 
357       if (!my_aes_crypt(MY_AES_ECB, what, (uchar*)sptr->ptr(), sptr->length(),
358                  (uchar*)str2->ptr(), &aes_length,
359                  rkey, AES_KEY_LENGTH / 8, 0, 0))
360       {
361         str2->length((uint) aes_length);
362         DBUG_ASSERT(collation.collation == &my_charset_bin);
363         str2->set_charset(&my_charset_bin);
364         return str2;
365       }
366     }
367   }
368   null_value=1;
369   return 0;
370 }
371 
372 bool Item_func_aes_encrypt::fix_length_and_dec()
373 {
374   max_length=my_aes_get_size(MY_AES_ECB, args[0]->max_length);
375   what= ENCRYPTION_FLAG_ENCRYPT;
376   return FALSE;
377 }
378 
379 
380 
381 bool Item_func_aes_decrypt::fix_length_and_dec()
382 {
383   max_length=args[0]->max_length;
384   maybe_null= 1;
385   what= ENCRYPTION_FLAG_DECRYPT;
386   return FALSE;
387 }
388 
389 
390 bool Item_func_to_base64::fix_length_and_dec()
391 {
392   maybe_null= args[0]->maybe_null;
393   collation.set(default_charset(), DERIVATION_COERCIBLE, MY_REPERTOIRE_ASCII);
394   if (args[0]->max_length > (uint) my_base64_encode_max_arg_length())
395   {
396     maybe_null= 1;
397     fix_char_length_ulonglong((ulonglong) my_base64_encode_max_arg_length());
398   }
399   else
400   {
401     int length= my_base64_needed_encoded_length((int) args[0]->max_length);
402     DBUG_ASSERT(length > 0);
403     fix_char_length_ulonglong((ulonglong) length - 1);
404   }
405   return FALSE;
406 }
407 
408 
409 String *Item_func_to_base64::val_str_ascii(String *str)
410 {
411   String *res= args[0]->val_str(&tmp_value);
412   bool too_long= false;
413   int length;
414   if (!res ||
415       res->length() > (uint) my_base64_encode_max_arg_length() ||
416       (too_long=
417        ((uint) (length= my_base64_needed_encoded_length((int) res->length())) >
418         current_thd->variables.max_allowed_packet)) ||
419       str->alloc((uint) length))
420   {
421     null_value= 1; // NULL input, too long input, or OOM.
422     if (too_long)
423     {
424       THD *thd= current_thd;
425       push_warning_printf(thd, Sql_condition::WARN_LEVEL_WARN,
426                           ER_WARN_ALLOWED_PACKET_OVERFLOWED,
427                           ER_THD(thd, ER_WARN_ALLOWED_PACKET_OVERFLOWED),
428                           func_name(),
429                           thd->variables.max_allowed_packet);
430     }
431     return 0;
432   }
433   my_base64_encode(res->ptr(), (int) res->length(), (char*) str->ptr());
434   DBUG_ASSERT(length > 0);
435   str->length((uint) length - 1); // Without trailing '\0'
436   null_value= 0;
437   return str;
438 }
439 
440 
441 bool Item_func_from_base64::fix_length_and_dec()
442 {
443   if (args[0]->max_length > (uint) my_base64_decode_max_arg_length())
444   {
445     fix_char_length_ulonglong((ulonglong) my_base64_decode_max_arg_length());
446   }
447   else
448   {
449     int length= my_base64_needed_decoded_length((int) args[0]->max_length);
450     fix_char_length_ulonglong((ulonglong) length);
451   }
452   maybe_null= 1; // Can be NULL, e.g. in case of badly formed input string
453   return FALSE;
454 }
455 
456 
457 String *Item_func_from_base64::val_str(String *str)
458 {
459   String *res= args[0]->val_str_ascii(&tmp_value);
460   int length;
461   const char *end_ptr;
462 
463   if (!res)
464     goto err;
465 
466   if (res->length() > (uint) my_base64_decode_max_arg_length() ||
467       ((uint) (length= my_base64_needed_decoded_length((int) res->length())) >
468        current_thd->variables.max_allowed_packet))
469   {
470     THD *thd= current_thd;
471     push_warning_printf(thd, Sql_condition::WARN_LEVEL_WARN,
472                         ER_WARN_ALLOWED_PACKET_OVERFLOWED,
473                         ER_THD(thd, ER_WARN_ALLOWED_PACKET_OVERFLOWED),
474                         func_name(),
475                         thd->variables.max_allowed_packet);
476     goto err;
477   }
478 
479   if (str->alloc((uint) length))
480     goto err;
481 
482   if ((length= my_base64_decode(res->ptr(), (int) res->length(),
483                                 (char *) str->ptr(), &end_ptr, 0)) < 0 ||
484       end_ptr < res->ptr() + res->length())
485   {
486     THD *thd= current_thd;
487     push_warning_printf(thd, Sql_condition::WARN_LEVEL_WARN,
488                         ER_BAD_BASE64_DATA, ER_THD(thd, ER_BAD_BASE64_DATA),
489                         (int) (end_ptr - res->ptr()));
490     goto err;
491   }
492 
493   str->length((uint) length);
494   null_value= 0;
495   return str;
496 err:
497   null_value= 1; // NULL input, too long input, OOM, or badly formed input
498   return 0;
499 }
500 ///////////////////////////////////////////////////////////////////////////////
501 
502 
503 const char *histogram_types[] =
504            {"SINGLE_PREC_HB", "DOUBLE_PREC_HB", 0};
505 static TYPELIB histogram_types_typelib=
506   { array_elements(histogram_types),
507     "histogram_types",
508     histogram_types, NULL};
509 const char *representation_by_type[]= {"%.3f", "%.5f"};
510 
511 String *Item_func_decode_histogram::val_str(String *str)
512 {
513   DBUG_ASSERT(fixed == 1);
514   char buff[STRING_BUFFER_USUAL_SIZE];
515   String *res, tmp(buff, sizeof(buff), &my_charset_bin);
516   int type;
517 
518   tmp.length(0);
519   if (!(res= args[0]->val_str(&tmp)) ||
520       (type= find_type(res->c_ptr_safe(),
521                        &histogram_types_typelib, MYF(0))) <= 0)
522   {
523     null_value= 1;
524     return 0;
525   }
526   type--;
527 
528   tmp.length(0);
529   if (!(res= args[1]->val_str(&tmp)))
530   {
531     null_value= 1;
532     return 0;
533   }
534   if (type == DOUBLE_PREC_HB && res->length() % 2 != 0)
535     res->length(res->length() - 1); // one byte is unused
536 
537   double prev= 0.0;
538   uint i;
539   str->length(0);
540   char numbuf[32];
541   const uchar *p= (uchar*)res->c_ptr_safe();
542   for (i= 0; i < res->length(); i++)
543   {
544     double val;
545     switch (type)
546     {
547     case SINGLE_PREC_HB:
548       val= p[i] / ((double)((1 << 8) - 1));
549       break;
550     case DOUBLE_PREC_HB:
551       val= uint2korr(p + i) / ((double)((1 << 16) - 1));
552       i++;
553       break;
554     default:
555       val= 0;
556       DBUG_ASSERT(0);
557     }
558     /* show delta with previous value */
559     size_t size= my_snprintf(numbuf, sizeof(numbuf),
560                           representation_by_type[type], val - prev);
561     str->append(numbuf, size);
562     str->append(",");
563     prev= val;
564   }
565   /* show delta with max */
566   size_t size= my_snprintf(numbuf, sizeof(numbuf),
567                         representation_by_type[type], 1.0 - prev);
568   str->append(numbuf, size);
569 
570   null_value=0;
571   return str;
572 }
573 
574 
575 ///////////////////////////////////////////////////////////////////////////////
576 
577 /*
578   Realloc the result buffer.
579   NOTE: We should be prudent in the initial allocation unit -- the
580   size of the arguments is a function of data distribution, which
581   can be any. Instead of overcommitting at the first row, we grow
582   the allocated amount by the factor of 2. This ensures that no
583   more than 25% of memory will be overcommitted on average.
584 
585   @param IN/OUT str    - the result string
586   @param IN     length - new total space required in "str"
587   @retval       false  - on success
588   @retval       true   - on error
589 */
590 
591 bool Item_func_concat::realloc_result(String *str, uint length) const
592 {
593   if (str->alloced_length() >= length)
594     return false; // Alloced space is big enough, nothing to do.
595 
596   if (str->alloced_length() == 0)
597     return str->alloc(length);
598 
599   /*
600     Item_func_concat::val_str() makes sure the result length does not grow
601     higher than max_allowed_packet. So "length" is limited to 1G here.
602     We can't say anything about the current value of str->alloced_length(),
603     as str was initially set by args[0]->val_str(str).
604     So multiplication by 2 can overflow, if args[0] for some reasons
605     did not limit the result to max_alloced_packet. But it's not harmful,
606     "str" will be reallocated exactly to "length" bytes in case of overflow.
607   */
608   uint new_length= MY_MAX(str->alloced_length() * 2, length);
609   return str->realloc(new_length);
610 }
611 
612 
613 /**
614   Concatenate args with the following premises:
615   If only one arg (which is ok), return value of arg;
616 */
617 
618 String *Item_func_concat::val_str(String *str)
619 {
620   DBUG_ASSERT(fixed == 1);
621   THD *thd= current_thd;
622   String *res;
623 
624   null_value=0;
625   if (!(res= args[0]->val_str(str)))
626     goto null;
627 
628   if (res != str)
629     str->copy_or_move(res->ptr(), res->length(), res->charset());
630 
631   for (uint i= 1 ; i < arg_count ; i++)
632   {
633     if (!(res= args[i]->val_str(&tmp_value)) ||
634         append_value(thd, str, res))
635       goto null;
636   }
637 
638   str->set_charset(collation.collation);
639   return str;
640 
641 null:
642   null_value= true;
643   return 0;
644 }
645 
646 
647 String *Item_func_concat_operator_oracle::val_str(String *str)
648 {
649   DBUG_ASSERT(fixed == 1);
650   THD *thd= current_thd;
651   String *res= NULL;
652   uint i;
653 
654   null_value=0;
655   // Search first non null argument
656   for (i= 0; i < arg_count; i++)
657   {
658     if ((res= args[i]->val_str(str)))
659       break;
660   }
661   if (!res)
662     goto null;
663 
664   if (res != str)
665     str->copy(res->ptr(), res->length(), res->charset());
666 
667   for (i++ ; i < arg_count ; i++)
668   {
669     if (!(res= args[i]->val_str(&tmp_value)) || res->length() == 0)
670      continue;
671     if (append_value(thd, str, res))
672       goto null;
673   }
674 
675   str->set_charset(collation.collation);
676   return str;
677 
678 null:
679   null_value= true;
680   return 0;
681 }
682 
683 
684 bool Item_func_concat::append_value(THD *thd, String *res, const String *app)
685 {
686   uint concat_len;
687   if ((concat_len= res->length() + app->length()) >
688       thd->variables.max_allowed_packet)
689   {
690     push_warning_printf(thd, Sql_condition::WARN_LEVEL_WARN,
691                         ER_WARN_ALLOWED_PACKET_OVERFLOWED,
692                         ER(ER_WARN_ALLOWED_PACKET_OVERFLOWED), func_name(),
693                         thd->variables.max_allowed_packet);
694     return true;
695   }
696   DBUG_ASSERT(!res->uses_buffer_owned_by(app));
697   DBUG_ASSERT(!app->uses_buffer_owned_by(res));
698   return realloc_result(res, concat_len) || res->append(*app);
699 }
700 
701 
702 bool Item_func_concat::fix_length_and_dec()
703 {
704   ulonglong char_length= 0;
705 
706   if (agg_arg_charsets_for_string_result(collation, args, arg_count))
707     return TRUE;
708 
709   for (uint i=0 ; i < arg_count ; i++)
710     char_length+= args[i]->max_char_length();
711 
712   fix_char_length_ulonglong(char_length);
713   return FALSE;
714 }
715 
716 /**
717   @details
718   Function des_encrypt() by tonu@spam.ee & monty
719   Works only if compiled with OpenSSL library support.
720   @return
721     A binary string where first character is CHAR(128 | key-number).
722     If one uses a string key key_number is 127.
723     Encryption result is longer than original by formula:
724   @code new_length= org_length + (8-(org_length % 8))+1 @endcode
725 */
726 
727 String *Item_func_des_encrypt::val_str(String *str)
728 {
729   DBUG_ASSERT(fixed == 1);
730 #if defined(HAVE_OPENSSL) && !defined(EMBEDDED_LIBRARY)
731   uint code= ER_WRONG_PARAMETERS_TO_PROCEDURE;
732   DES_cblock ivec;
733   struct st_des_keyblock keyblock;
734   struct st_des_keyschedule keyschedule;
735   const char *append_str="********";
736   uint key_number, res_length, tail;
737   String *res= args[0]->val_str(&tmp_value);
738 
739   if ((null_value= args[0]->null_value))
740     return 0;                                   // ENCRYPT(NULL) == NULL
741   if ((res_length=res->length()) == 0)
742     return make_empty_result();
743   if (arg_count == 1)
744   {
745     /* Protect against someone doing FLUSH DES_KEY_FILE */
746     mysql_mutex_lock(&LOCK_des_key_file);
747     keyschedule= des_keyschedule[key_number=des_default_key];
748     mysql_mutex_unlock(&LOCK_des_key_file);
749   }
750   else if (args[1]->result_type() == INT_RESULT)
751   {
752     key_number= (uint) args[1]->val_int();
753     if (key_number > 9)
754       goto error;
755     mysql_mutex_lock(&LOCK_des_key_file);
756     keyschedule= des_keyschedule[key_number];
757     mysql_mutex_unlock(&LOCK_des_key_file);
758   }
759   else
760   {
761     String *keystr= args[1]->val_str(str);
762     if (!keystr)
763       goto error;
764     key_number=127;				// User key string
765 
766     /* We make good 24-byte (168 bit) key from given plaintext key with MD5 */
767     bzero((char*) &ivec,sizeof(ivec));
768     if (!EVP_BytesToKey(EVP_des_ede3_cbc(),EVP_md5(),NULL,
769 		   (uchar*) keystr->ptr(), (int) keystr->length(),
770 		   1, (uchar*) &keyblock,ivec))
771       goto error;
772     DES_set_key_unchecked(&keyblock.key1,&keyschedule.ks1);
773     DES_set_key_unchecked(&keyblock.key2,&keyschedule.ks2);
774     DES_set_key_unchecked(&keyblock.key3,&keyschedule.ks3);
775   }
776 
777   /*
778      The problem: DES algorithm requires original data to be in 8-bytes
779      chunks. Missing bytes get filled with '*'s and result of encryption
780      can be up to 8 bytes longer than original string. When decrypted,
781      we do not know the size of original string :(
782      We add one byte with value 0x1..0x8 as the last byte of the padded
783      string marking change of string length.
784   */
785 
786   tail= 8 - (res_length % 8);                   // 1..8 marking extra length
787   res_length+=tail;
788   if (tmp_arg.realloc(res_length))
789     goto error;
790   tmp_arg.length(0);
791   tmp_arg.append(res->ptr(), res->length());
792   code= ER_OUT_OF_RESOURCES;
793   if (tmp_arg.append(append_str, tail) || str->alloc(res_length+1))
794     goto error;
795   tmp_arg[res_length-1]=tail;                   // save extra length
796   str->realloc(res_length+1);
797   str->length(res_length+1);
798   str->set_charset(&my_charset_bin);
799   (*str)[0]=(char) (128 | key_number);
800   // Real encryption
801   bzero((char*) &ivec,sizeof(ivec));
802   DES_ede3_cbc_encrypt((const uchar*) (tmp_arg.ptr()),
803 		       (uchar*) (str->ptr()+1),
804 		       res_length,
805 		       &keyschedule.ks1,
806 		       &keyschedule.ks2,
807 		       &keyschedule.ks3,
808 		       &ivec, TRUE);
809   return str;
810 
811 error:
812   THD *thd= current_thd;
813   push_warning_printf(thd,Sql_condition::WARN_LEVEL_WARN,
814                       code, ER_THD(thd, code),
815                       "des_encrypt");
816 #else
817   THD *thd= current_thd;
818   push_warning_printf(thd, Sql_condition::WARN_LEVEL_WARN,
819                       ER_FEATURE_DISABLED, ER_THD(thd, ER_FEATURE_DISABLED),
820                       "des_encrypt", "--with-ssl");
821 #endif /* defined(HAVE_OPENSSL) && !defined(EMBEDDED_LIBRARY) */
822   null_value=1;
823   return 0;
824 }
825 
826 
827 String *Item_func_des_decrypt::val_str(String *str)
828 {
829   DBUG_ASSERT(fixed == 1);
830 #if defined(HAVE_OPENSSL) && !defined(EMBEDDED_LIBRARY)
831   uint code= ER_WRONG_PARAMETERS_TO_PROCEDURE;
832   DES_cblock ivec;
833   struct st_des_keyblock keyblock;
834   struct st_des_keyschedule keyschedule;
835   String *res= args[0]->val_str(&tmp_value);
836   uint length,tail;
837 
838   if ((null_value= args[0]->null_value))
839     return 0;
840   length= res->length();
841   if (length < 9 || (length % 8) != 1 || !((*res)[0] & 128))
842     return res;				// Skip decryption if not encrypted
843 
844   if (arg_count == 1)			// If automatic uncompression
845   {
846     uint key_number=(uint) (*res)[0] & 127;
847     // Check if automatic key and that we have privilege to uncompress using it
848     if (!(current_thd->security_ctx->master_access & SUPER_ACL) ||
849         key_number > 9)
850       goto error;
851 
852     mysql_mutex_lock(&LOCK_des_key_file);
853     keyschedule= des_keyschedule[key_number];
854     mysql_mutex_unlock(&LOCK_des_key_file);
855   }
856   else
857   {
858     // We make good 24-byte (168 bit) key from given plaintext key with MD5
859     String *keystr= args[1]->val_str(str);
860     if (!keystr)
861       goto error;
862 
863     bzero((char*) &ivec,sizeof(ivec));
864     if (!EVP_BytesToKey(EVP_des_ede3_cbc(),EVP_md5(),NULL,
865 		   (uchar*) keystr->ptr(),(int) keystr->length(),
866 		   1,(uchar*) &keyblock,ivec))
867       goto error;
868     // Here we set all 64-bit keys (56 effective) one by one
869     DES_set_key_unchecked(&keyblock.key1,&keyschedule.ks1);
870     DES_set_key_unchecked(&keyblock.key2,&keyschedule.ks2);
871     DES_set_key_unchecked(&keyblock.key3,&keyschedule.ks3);
872   }
873   code= ER_OUT_OF_RESOURCES;
874   if (str->alloc(length-1))
875     goto error;
876 
877   bzero((char*) &ivec,sizeof(ivec));
878   DES_ede3_cbc_encrypt((const uchar*) res->ptr()+1,
879 		       (uchar*) (str->ptr()),
880 		       length-1,
881 		       &keyschedule.ks1,
882 		       &keyschedule.ks2,
883 		       &keyschedule.ks3,
884 		       &ivec, FALSE);
885   /* Restore old length of key */
886   if ((tail=(uint) (uchar) (*str)[length-2]) > 8)
887     goto wrong_key;				     // Wrong key
888   str->length(length-1-tail);
889   str->set_charset(&my_charset_bin);
890   return str;
891 
892 error:
893   {
894     THD *thd= current_thd;
895     push_warning_printf(thd, Sql_condition::WARN_LEVEL_WARN,
896                         code, ER_THD(thd, code),
897                         "des_decrypt");
898   }
899 wrong_key:
900 #else
901   {
902     THD *thd= current_thd;
903     push_warning_printf(thd, Sql_condition::WARN_LEVEL_WARN,
904                         ER_FEATURE_DISABLED, ER_THD(thd, ER_FEATURE_DISABLED),
905                         "des_decrypt", "--with-ssl");
906   }
907 #endif /* defined(HAVE_OPENSSL) && !defined(EMBEDDED_LIBRARY) */
908   null_value=1;
909   return 0;
910 }
911 
912 
913 /**
914   concat with separator. First arg is the separator
915   concat_ws takes at least two arguments.
916 */
917 
918 String *Item_func_concat_ws::val_str(String *str)
919 {
920   DBUG_ASSERT(fixed == 1);
921   char tmp_str_buff[10];
922   String tmp_sep_str(tmp_str_buff, sizeof(tmp_str_buff),default_charset_info),
923          *sep_str, *res, *res2,*use_as_buff;
924   uint i;
925   bool is_const= 0;
926   THD *thd= 0;
927 
928   null_value=0;
929   if (!(sep_str= args[0]->val_str(&tmp_sep_str)))
930     goto null;
931 
932   use_as_buff= &tmp_value;
933   str->length(0);				// QQ; Should be removed
934   res=str;                                      // If 0 arg_count
935 
936   // Skip until non-null argument is found.
937   // If not, return the empty string
938   for (i=1; i < arg_count; i++)
939     if ((res= args[i]->val_str(str)))
940     {
941       is_const= args[i]->const_item();
942       break;
943     }
944 
945   if (i ==  arg_count)
946     return make_empty_result();
947 
948   for (i++; i < arg_count ; i++)
949   {
950     if (!(res2= args[i]->val_str(use_as_buff)))
951       continue;					// Skip NULL
952 
953     if (!thd)
954       thd= current_thd;
955     if (res->length() + sep_str->length() + res2->length() >
956 	thd->variables.max_allowed_packet)
957     {
958       push_warning_printf(thd, Sql_condition::WARN_LEVEL_WARN,
959 			  ER_WARN_ALLOWED_PACKET_OVERFLOWED,
960 			  ER_THD(thd, ER_WARN_ALLOWED_PACKET_OVERFLOWED),
961                           func_name(),
962 			  thd->variables.max_allowed_packet);
963       goto null;
964     }
965     if (!is_const && res->alloced_length() >=
966 	res->length() + sep_str->length() + res2->length())
967     {						// Use old buffer
968       res->append(*sep_str);			// res->length() > 0 always
969       res->append(*res2);
970     }
971     else if (str->alloced_length() >=
972 	     res->length() + sep_str->length() + res2->length())
973     {
974       /* We have room in str;  We can't get any errors here */
975       if (str->ptr() == res2->ptr())
976       {						// This is quite uncommon!
977 	str->replace(0,0,*sep_str);
978 	str->replace(0,0,*res);
979       }
980       else
981       {
982 	str->copy(*res);
983 	str->append(*sep_str);
984 	str->append(*res2);
985       }
986       res=str;
987       use_as_buff= &tmp_value;
988     }
989     else if (res == &tmp_value)
990     {
991       if (res->append(*sep_str) || res->append(*res2))
992 	goto null; // Must be a blob
993     }
994     else if (res2 == &tmp_value)
995     {						// This can happen only 1 time
996       if (tmp_value.replace(0,0,*sep_str) || tmp_value.replace(0,0,*res))
997 	goto null;
998       res= &tmp_value;
999       use_as_buff=str;				// Put next arg here
1000     }
1001     else if (tmp_value.is_alloced() && res2->ptr() >= tmp_value.ptr() &&
1002 	     res2->ptr() < tmp_value.ptr() + tmp_value.alloced_length())
1003     {
1004       /*
1005 	This happens really seldom:
1006 	In this case res2 is sub string of tmp_value.  We will
1007 	now work in place in tmp_value to set it to res | sep_str | res2
1008       */
1009       /* Chop the last characters in tmp_value that isn't in res2 */
1010       tmp_value.length((uint32) (res2->ptr() - tmp_value.ptr()) +
1011 		       res2->length());
1012       /* Place res2 at start of tmp_value, remove chars before res2 */
1013       if (tmp_value.replace(0,(uint32) (res2->ptr() - tmp_value.ptr()),
1014 			    *res) ||
1015 	  tmp_value.replace(res->length(),0, *sep_str))
1016 	goto null;
1017       res= &tmp_value;
1018       use_as_buff=str;			// Put next arg here
1019     }
1020     else
1021     {						// Two big const strings
1022       /*
1023         NOTE: We should be prudent in the initial allocation unit -- the
1024         size of the arguments is a function of data distribution, which can
1025         be any. Instead of overcommitting at the first row, we grow the
1026         allocated amount by the factor of 2. This ensures that no more than
1027         25% of memory will be overcommitted on average.
1028       */
1029 
1030       uint concat_len= res->length() + sep_str->length() + res2->length();
1031 
1032       if (tmp_value.alloced_length() < concat_len)
1033       {
1034         if (tmp_value.alloced_length() == 0)
1035         {
1036           if (tmp_value.alloc(concat_len))
1037             goto null;
1038         }
1039         else
1040         {
1041           uint new_len = MY_MAX(tmp_value.alloced_length() * 2, concat_len);
1042 
1043           if (tmp_value.realloc(new_len))
1044             goto null;
1045         }
1046       }
1047 
1048       if (tmp_value.copy(*res) ||
1049 	  tmp_value.append(*sep_str) ||
1050 	  tmp_value.append(*res2))
1051 	goto null;
1052       res= &tmp_value;
1053       use_as_buff=str;
1054     }
1055   }
1056   res->set_charset(collation.collation);
1057   return res;
1058 
1059 null:
1060   null_value=1;
1061   return 0;
1062 }
1063 
1064 
1065 bool Item_func_concat_ws::fix_length_and_dec()
1066 {
1067   ulonglong char_length;
1068 
1069   if (agg_arg_charsets_for_string_result(collation, args, arg_count))
1070     return TRUE;
1071 
1072   /*
1073      arg_count cannot be less than 2,
1074      it is done on parser level in sql_yacc.yy
1075      so, (arg_count - 2) is safe here.
1076   */
1077   char_length= (ulonglong) args[0]->max_char_length() * (arg_count - 2);
1078   for (uint i=1 ; i < arg_count ; i++)
1079     char_length+= args[i]->max_char_length();
1080 
1081   fix_char_length_ulonglong(char_length);
1082   return FALSE;
1083 }
1084 
1085 
1086 String *Item_func_reverse::val_str(String *str)
1087 {
1088   DBUG_ASSERT(fixed == 1);
1089   String *res= args[0]->val_str(&tmp_value);
1090   const char *ptr, *end;
1091   char *tmp;
1092 
1093   if ((null_value=args[0]->null_value))
1094     return 0;
1095   /* An empty string is a special case as the string pointer may be null */
1096   if (!res->length())
1097     return make_empty_result();
1098   if (str->alloced_length() < res->length() &&
1099       str->realloc(res->length()))
1100   {
1101     null_value= 1;
1102     return 0;
1103   }
1104   str->length(res->length());
1105   str->set_charset(res->charset());
1106   ptr= res->ptr();
1107   end= res->end();
1108   tmp= (char *) str->end();
1109 #ifdef USE_MB
1110   if (use_mb(res->charset()))
1111   {
1112     uint32 l;
1113     while (ptr < end)
1114     {
1115       if ((l= my_ismbchar(res->charset(),ptr,end)))
1116       {
1117         tmp-= l;
1118         DBUG_ASSERT(tmp >= str->ptr());
1119         memcpy(tmp,ptr,l);
1120         ptr+= l;
1121       }
1122       else
1123         *--tmp= *ptr++;
1124     }
1125   }
1126   else
1127 #endif /* USE_MB */
1128   {
1129     while (ptr < end)
1130       *--tmp= *ptr++;
1131   }
1132   return str;
1133 }
1134 
1135 
1136 bool Item_func_reverse::fix_length_and_dec()
1137 {
1138   if (agg_arg_charsets_for_string_result(collation, args, 1))
1139     return TRUE;
1140   DBUG_ASSERT(collation.collation != NULL);
1141   fix_char_length(args[0]->max_char_length());
1142   return FALSE;
1143 }
1144 
1145 /**
1146   Replace all occurrences of string2 in string1 with string3.
1147 
1148   Don't reallocate val_str() if not needed.
1149 
1150   @todo
1151     Fix that this works with binary strings when using USE_MB
1152 */
1153 
1154 String *Item_func_replace::val_str_internal(String *str,
1155                                             String *empty_string_for_null)
1156 {
1157   DBUG_ASSERT(fixed == 1);
1158   String *res,*res2,*res3;
1159   int offset;
1160   uint from_length,to_length;
1161   bool alloced=0;
1162 #ifdef USE_MB
1163   const char *ptr,*end,*strend,*search,*search_end;
1164   uint32 l;
1165   bool binary_cmp;
1166 #endif
1167   THD *thd= 0;
1168 
1169   null_value=0;
1170   res=args[0]->val_str(str);
1171   if (args[0]->null_value)
1172     goto null;
1173   res2=args[1]->val_str(&tmp_value);
1174   if (args[1]->null_value)
1175   {
1176     if (!empty_string_for_null)
1177       goto null;
1178     res2= empty_string_for_null;
1179   }
1180   res->set_charset(collation.collation);
1181 
1182 #ifdef USE_MB
1183   binary_cmp = ((res->charset()->state & MY_CS_BINSORT) || !use_mb(res->charset()));
1184 #endif
1185 
1186   if (res2->length() == 0)
1187     return res;
1188 #ifndef USE_MB
1189   if ((offset=res->strstr(*res2)) < 0)
1190     return res;
1191 #else
1192   offset=0;
1193   if (binary_cmp && (offset=res->strstr(*res2)) < 0)
1194     return res;
1195 #endif
1196   if (!(res3=args[2]->val_str(&tmp_value2)))
1197   {
1198     if (!empty_string_for_null)
1199       goto null;
1200     res3= empty_string_for_null;
1201   }
1202   from_length= res2->length();
1203   to_length=   res3->length();
1204 
1205 #ifdef USE_MB
1206   if (!binary_cmp)
1207   {
1208     search=res2->ptr();
1209     search_end=search+from_length;
1210 redo:
1211     DBUG_ASSERT(res->ptr() || !offset);
1212     ptr=res->ptr()+offset;
1213     strend=res->ptr()+res->length();
1214     /*
1215       In some cases val_str() can return empty string
1216       with ptr() == NULL and length() == 0.
1217       Let's check strend to avoid overflow.
1218     */
1219     end= strend ? strend - from_length + 1 : NULL;
1220     while (ptr < end)
1221     {
1222       if (*ptr == *search)
1223       {
1224         char *i,*j;
1225         i=(char*) ptr+1; j=(char*) search+1;
1226         while (j != search_end)
1227           if (*i++ != *j++) goto skip;
1228         offset= (int) (ptr-res->ptr());
1229 
1230         if (!thd)
1231           thd= current_thd;
1232 
1233         if (res->length()-from_length + to_length >
1234             thd->variables.max_allowed_packet)
1235         {
1236           push_warning_printf(thd, Sql_condition::WARN_LEVEL_WARN,
1237                               ER_WARN_ALLOWED_PACKET_OVERFLOWED,
1238                               ER_THD(thd, ER_WARN_ALLOWED_PACKET_OVERFLOWED),
1239                               func_name(),
1240                               thd->variables.max_allowed_packet);
1241 
1242           goto null;
1243         }
1244         if (!alloced)
1245         {
1246           alloced=1;
1247           res=copy_if_not_alloced(str,res,res->length()+to_length);
1248         }
1249         res->replace((uint) offset,from_length,*res3);
1250         offset+=(int) to_length;
1251         goto redo;
1252       }
1253   skip:
1254       if ((l=my_ismbchar(res->charset(), ptr,strend))) ptr+=l;
1255       else ++ptr;
1256     }
1257   }
1258   else
1259 #endif /* USE_MB */
1260   {
1261     thd= current_thd;
1262     do
1263     {
1264       if (res->length()-from_length + to_length >
1265 	  thd->variables.max_allowed_packet)
1266       {
1267 	push_warning_printf(thd, Sql_condition::WARN_LEVEL_WARN,
1268 			    ER_WARN_ALLOWED_PACKET_OVERFLOWED,
1269 			    ER_THD(thd, ER_WARN_ALLOWED_PACKET_OVERFLOWED),
1270                             func_name(),
1271 			    thd->variables.max_allowed_packet);
1272         goto null;
1273       }
1274       if (!alloced)
1275       {
1276         alloced=1;
1277         res=copy_if_not_alloced(str,res,res->length()+to_length);
1278       }
1279       res->replace((uint) offset,from_length,*res3);
1280       offset+=(int) to_length;
1281     }
1282     while ((offset=res->strstr(*res2,(uint) offset)) >= 0);
1283   }
1284   if (empty_string_for_null && !res->length())
1285     goto null;
1286 
1287   return res;
1288 
1289 null:
1290   null_value=1;
1291   return 0;
1292 }
1293 
1294 
1295 bool Item_func_replace::fix_length_and_dec()
1296 {
1297   ulonglong char_length= (ulonglong) args[0]->max_char_length();
1298   int diff=(int) (args[2]->max_char_length() - args[1]->max_char_length());
1299   if (diff > 0 && args[1]->max_char_length())
1300   {						// Calculate of maxreplaces
1301     ulonglong max_substrs= char_length / args[1]->max_char_length();
1302     char_length+= max_substrs * (uint) diff;
1303   }
1304 
1305   if (agg_arg_charsets_for_string_result_with_comparison(collation, args, 3))
1306     return TRUE;
1307   fix_char_length_ulonglong(char_length);
1308   return FALSE;
1309 }
1310 
1311 
1312 /*********************************************************************/
1313 bool Item_func_regexp_replace::fix_fields(THD *thd, Item **ref)
1314 {
1315   re.set_recursion_limit(thd);
1316   return Item_str_func::fix_fields(thd, ref);
1317 }
1318 
1319 
1320 bool Item_func_regexp_replace::fix_length_and_dec()
1321 {
1322   if (agg_arg_charsets_for_string_result_with_comparison(collation, args, 3))
1323     return TRUE;
1324   max_length= MAX_BLOB_WIDTH;
1325   re.init(collation.collation, 0);
1326   re.fix_owner(this, args[0], args[1]);
1327   return FALSE;
1328 }
1329 
1330 
1331 /*
1332   Traverse through the replacement string and append to "str".
1333   Sub-pattern references \0 .. \9 are recognized, which are replaced
1334   to the chunks of the source string.
1335 */
1336 bool Item_func_regexp_replace::append_replacement(String *str,
1337                                                   const LEX_CSTRING *source,
1338                                                   const LEX_CSTRING *replace)
1339 {
1340   const char *beg= replace->str;
1341   const char *end= beg + replace->length;
1342   CHARSET_INFO *cs= re.library_charset();
1343 
1344   for ( ; ; )
1345   {
1346     my_wc_t wc;
1347     int cnv, n;
1348 
1349     if ((cnv= cs->cset->mb_wc(cs, &wc, (const uchar *) beg,
1350                                        (const uchar *) end)) < 1)
1351       break; /* End of line */
1352     beg+= cnv;
1353 
1354     if (wc != '\\')
1355     {
1356       if (str->append(beg - cnv, cnv, cs))
1357         return true;
1358       continue;
1359     }
1360 
1361     if ((cnv= cs->cset->mb_wc(cs, &wc, (const uchar *) beg,
1362                                        (const uchar *) end)) < 1)
1363       break; /* End of line */
1364     beg+= cnv;
1365 
1366     if ((n= ((int) wc) - '0') >= 0 && n <= 9)
1367     {
1368       if (n < re.nsubpatterns())
1369       {
1370         /* A valid sub-pattern reference found */
1371         int pbeg= re.subpattern_start(n), plength= re.subpattern_end(n) - pbeg;
1372         if (str->append(source->str + pbeg, plength, cs))
1373           return true;
1374       }
1375     }
1376     else
1377     {
1378       /*
1379          A non-digit character following after '\'.
1380          Just add the character itself.
1381        */
1382       if (str->append(beg - cnv, cnv, cs))
1383         return false;
1384     }
1385   }
1386   return false;
1387 }
1388 
1389 
1390 String *Item_func_regexp_replace::val_str(String *str)
1391 {
1392   DBUG_ASSERT(fixed == 1);
1393   char buff0[MAX_FIELD_WIDTH];
1394   char buff2[MAX_FIELD_WIDTH];
1395   String tmp0(buff0,sizeof(buff0),&my_charset_bin);
1396   String tmp2(buff2,sizeof(buff2),&my_charset_bin);
1397   String *source= args[0]->val_str(&tmp0);
1398   String *replace= args[2]->val_str(&tmp2);
1399   LEX_CSTRING src, rpl;
1400   int startoffset= 0;
1401 
1402   if ((null_value= (args[0]->null_value || args[2]->null_value ||
1403                     re.recompile(args[1]))))
1404     return (String *) 0;
1405 
1406   if (!(source= re.convert_if_needed(source, &re.subject_converter)) ||
1407       !(replace= re.convert_if_needed(replace, &re.replace_converter)))
1408     goto err;
1409 
1410   src= source->lex_cstring();
1411   rpl= replace->lex_cstring();
1412 
1413   str->length(0);
1414   str->set_charset(collation.collation);
1415 
1416   for ( ; ; ) // Iterate through all matches
1417   {
1418 
1419     if (re.exec(src.str, src.length, startoffset))
1420       goto err;
1421 
1422     if (!re.match() || re.subpattern_length(0) == 0)
1423     {
1424       /*
1425         No match or an empty match.
1426         Append the rest of the source string
1427         starting from startoffset until the end of the source.
1428       */
1429       if (str->append(src.str + startoffset, src.length - startoffset, re.library_charset()))
1430         goto err;
1431       return str;
1432     }
1433 
1434     /*
1435       Append prefix, the part before the matching pattern.
1436       starting from startoffset until the next match
1437     */
1438     if (str->append(src.str + startoffset, re.subpattern_start(0) - startoffset, re.library_charset()))
1439       goto err;
1440 
1441     // Append replacement
1442     if (append_replacement(str, &src, &rpl))
1443       goto err;
1444 
1445     // Set the new start point as the end of previous match
1446     startoffset= re.subpattern_end(0);
1447   }
1448   return str;
1449 
1450 err:
1451   null_value= true;
1452   return (String *) 0;
1453 }
1454 
1455 
1456 bool Item_func_regexp_substr::fix_fields(THD *thd, Item **ref)
1457 {
1458   re.set_recursion_limit(thd);
1459   return Item_str_func::fix_fields(thd, ref);
1460 }
1461 
1462 
1463 bool Item_func_regexp_substr::fix_length_and_dec()
1464 {
1465   if (agg_arg_charsets_for_string_result_with_comparison(collation, args, 2))
1466     return TRUE;
1467   fix_char_length(args[0]->max_char_length());
1468   re.init(collation.collation, 0);
1469   re.fix_owner(this, args[0], args[1]);
1470   return FALSE;
1471 }
1472 
1473 
1474 String *Item_func_regexp_substr::val_str(String *str)
1475 {
1476   DBUG_ASSERT(fixed == 1);
1477   char buff0[MAX_FIELD_WIDTH];
1478   String tmp0(buff0,sizeof(buff0),&my_charset_bin);
1479   String *source= args[0]->val_str(&tmp0);
1480 
1481   if ((null_value= (args[0]->null_value || re.recompile(args[1]))))
1482     return (String *) 0;
1483 
1484   if (!(source= re.convert_if_needed(source, &re.subject_converter)))
1485     goto err;
1486 
1487   str->length(0);
1488   str->set_charset(collation.collation);
1489 
1490   if (re.exec(source->ptr(), source->length(), 0))
1491     goto err;
1492 
1493   if (!re.match())
1494     return str;
1495 
1496   if (str->append(source->ptr() + re.subpattern_start(0),
1497                   re.subpattern_end(0) - re.subpattern_start(0),
1498                   re.library_charset()))
1499     goto err;
1500 
1501   return str;
1502 
1503 err:
1504   null_value= true;
1505   return (String *) 0;
1506 }
1507 
1508 
1509 /************************************************************************/
1510 
1511 
1512 String *Item_func_insert::val_str(String *str)
1513 {
1514   DBUG_ASSERT(fixed == 1);
1515   String *res,*res2;
1516   longlong start, length;  /* must be longlong to avoid truncation */
1517 
1518   null_value=0;
1519   res=args[0]->val_str(str);
1520   res2=args[3]->val_str(&tmp_value);
1521   start= args[1]->val_int() - 1;
1522   length= args[2]->val_int();
1523 
1524   if (args[0]->null_value || args[1]->null_value || args[2]->null_value ||
1525       args[3]->null_value)
1526     goto null; /* purecov: inspected */
1527 
1528   if ((start < 0) || (start > res->length()))
1529     return res;                                 // Wrong param; skip insert
1530   if ((length < 0) || (length > res->length()))
1531     length= res->length();
1532 
1533   /*
1534     There is one exception not handled (intentionally) by the character set
1535     aggregation code. If one string is strong side and is binary, and
1536     another one is weak side and is a multi-byte character string,
1537     then we need to operate on the second string in terms on bytes when
1538     calling ::numchars() and ::charpos(), rather than in terms of characters.
1539     Lets substitute its character set to binary.
1540   */
1541   if (collation.collation == &my_charset_bin)
1542   {
1543     res->set_charset(&my_charset_bin);
1544     res2->set_charset(&my_charset_bin);
1545   }
1546 
1547   /* start and length are now sufficiently valid to pass to charpos function */
1548    start= res->charpos((int) start);
1549    length= res->charpos((int) length, (uint32) start);
1550 
1551   /* Re-testing with corrected params */
1552   if (start + 1 > res->length()) // remember, start = args[1].val_int() - 1
1553     return res; /* purecov: inspected */        // Wrong param; skip insert
1554   if (length > res->length() - start)
1555     length= res->length() - start;
1556 
1557   {
1558     THD *thd= current_thd;
1559     if ((ulonglong) (res->length() - length + res2->length()) >
1560         (ulonglong) thd->variables.max_allowed_packet)
1561     {
1562       push_warning_printf(thd, Sql_condition::WARN_LEVEL_WARN,
1563                           ER_WARN_ALLOWED_PACKET_OVERFLOWED,
1564                           ER_THD(thd, ER_WARN_ALLOWED_PACKET_OVERFLOWED),
1565                           func_name(), thd->variables.max_allowed_packet);
1566       goto null;
1567     }
1568   }
1569   res=copy_if_not_alloced(str,res,res->length());
1570   res->replace((uint32) start,(uint32) length,*res2);
1571   return res;
1572 null:
1573   null_value=1;
1574   return 0;
1575 }
1576 
1577 
1578 bool Item_func_insert::fix_length_and_dec()
1579 {
1580   ulonglong char_length;
1581 
1582   // Handle character set for args[0] and args[3].
1583   if (agg_arg_charsets_for_string_result(collation, args, 2, 3))
1584     return TRUE;
1585   char_length= ((ulonglong) args[0]->max_char_length() +
1586                 (ulonglong) args[3]->max_char_length());
1587   fix_char_length_ulonglong(char_length);
1588   return FALSE;
1589 }
1590 
1591 
1592 String *Item_str_conv::val_str(String *str)
1593 {
1594   DBUG_ASSERT(fixed == 1);
1595   String *res;
1596   size_t alloced_length, len;
1597 
1598   if ((null_value= (!(res= args[0]->val_str(&tmp_value)) ||
1599                     str->alloc((alloced_length= res->length() * multiply)))))
1600     return 0;
1601 
1602   len= converter(collation.collation, (char*) res->ptr(), res->length(),
1603                                       (char*) str->ptr(), alloced_length);
1604   DBUG_ASSERT(len <= alloced_length);
1605   str->set_charset(collation.collation);
1606   str->length(len);
1607   return str;
1608 }
1609 
1610 
1611 bool Item_func_lcase::fix_length_and_dec()
1612 {
1613   if (agg_arg_charsets_for_string_result(collation, args, 1))
1614     return TRUE;
1615   DBUG_ASSERT(collation.collation != NULL);
1616   multiply= collation.collation->casedn_multiply;
1617   converter= collation.collation->cset->casedn;
1618   fix_char_length_ulonglong((ulonglong) args[0]->max_char_length() * multiply);
1619   return FALSE;
1620 }
1621 
1622 bool Item_func_ucase::fix_length_and_dec()
1623 {
1624   if (agg_arg_charsets_for_string_result(collation, args, 1))
1625     return TRUE;
1626   DBUG_ASSERT(collation.collation != NULL);
1627   multiply= collation.collation->caseup_multiply;
1628   converter= collation.collation->cset->caseup;
1629   fix_char_length_ulonglong((ulonglong) args[0]->max_char_length() * multiply);
1630   return FALSE;
1631 }
1632 
1633 
1634 String *Item_func_left::val_str(String *str)
1635 {
1636   DBUG_ASSERT(fixed == 1);
1637   String *res= args[0]->val_str(str);
1638 
1639   /* must be longlong to avoid truncation */
1640   longlong length= args[1]->val_int();
1641   uint char_pos;
1642 
1643   if ((null_value=(args[0]->null_value || args[1]->null_value)))
1644     return 0;
1645 
1646   /* if "unsigned_flag" is set, we have a *huge* positive number. */
1647   if ((length <= 0) && (!args[1]->unsigned_flag))
1648     return make_empty_result();
1649   if ((res->length() <= (ulonglong) length) ||
1650       (res->length() <= (char_pos= res->charpos((int) length))))
1651     return res;
1652 
1653   tmp_value.set(*res, 0, char_pos);
1654   return &tmp_value;
1655 }
1656 
1657 
1658 void Item_str_func::left_right_max_length()
1659 {
1660   uint32 char_length= args[0]->max_char_length();
1661   if (args[1]->const_item() && !args[1]->is_expensive())
1662   {
1663     Repeat_count tmp(args[1]);
1664     set_if_smaller(char_length, (uint) tmp.count());
1665   }
1666   fix_char_length(char_length);
1667 }
1668 
1669 
1670 bool Item_func_left::fix_length_and_dec()
1671 {
1672   if (agg_arg_charsets_for_string_result(collation, args, 1))
1673     return TRUE;
1674   DBUG_ASSERT(collation.collation != NULL);
1675   left_right_max_length();
1676   return FALSE;
1677 }
1678 
1679 
1680 String *Item_func_right::val_str(String *str)
1681 {
1682   DBUG_ASSERT(fixed == 1);
1683   String *res= args[0]->val_str(str);
1684   /* must be longlong to avoid truncation */
1685   longlong length= args[1]->val_int();
1686 
1687   if ((null_value=(args[0]->null_value || args[1]->null_value)))
1688     return 0; /* purecov: inspected */
1689 
1690   /* if "unsigned_flag" is set, we have a *huge* positive number. */
1691   if ((length <= 0) && (!args[1]->unsigned_flag))
1692     return make_empty_result(); /* purecov: inspected */
1693 
1694   if (res->length() <= (ulonglong) length)
1695     return res; /* purecov: inspected */
1696 
1697   uint start=res->numchars();
1698   if (start <= (uint) length)
1699     return res;
1700   start=res->charpos(start - (uint) length);
1701   tmp_value.set(*res,start,res->length()-start);
1702   return &tmp_value;
1703 }
1704 
1705 
1706 bool Item_func_right::fix_length_and_dec()
1707 {
1708   if (agg_arg_charsets_for_string_result(collation, args, 1))
1709     return TRUE;
1710   DBUG_ASSERT(collation.collation != NULL);
1711   left_right_max_length();
1712   return FALSE;
1713 }
1714 
1715 
1716 String *Item_func_substr::val_str(String *str)
1717 {
1718   DBUG_ASSERT(fixed == 1);
1719   String *res  = args[0]->val_str(str);
1720   /* must be longlong to avoid truncation */
1721   longlong start= get_position();
1722   /* Assumes that the maximum length of a String is < INT_MAX32. */
1723   /* Limit so that code sees out-of-bound value properly. */
1724   longlong length= arg_count == 3 ? args[2]->val_int() : INT_MAX32;
1725   longlong tmp_length;
1726 
1727   if ((null_value=(args[0]->null_value || args[1]->null_value ||
1728 		   (arg_count == 3 && args[2]->null_value))))
1729     return 0; /* purecov: inspected */
1730 
1731   /* Negative or zero length, will return empty string. */
1732   if ((arg_count == 3) && (length <= 0) &&
1733       (length == 0 || !args[2]->unsigned_flag))
1734     return make_empty_result();
1735 
1736   /* Assumes that the maximum length of a String is < INT_MAX32. */
1737   /* Set here so that rest of code sees out-of-bound value as such. */
1738   if ((length <= 0) || (length > INT_MAX32))
1739     length= INT_MAX32;
1740 
1741   /* if "unsigned_flag" is set, we have a *huge* positive number. */
1742   /* Assumes that the maximum length of a String is < INT_MAX32. */
1743   if ((!args[1]->unsigned_flag && (start < INT_MIN32 || start > INT_MAX32)) ||
1744       (args[1]->unsigned_flag && ((ulonglong) start > INT_MAX32)))
1745     return make_empty_result();
1746 
1747   start= ((start < 0) ? res->numchars() + start : start - 1);
1748   start= res->charpos((int) start);
1749   if ((start < 0) || ((uint) start + 1 > res->length()))
1750     return make_empty_result();
1751 
1752   length= res->charpos((int) length, (uint32) start);
1753   tmp_length= res->length() - start;
1754   length= MY_MIN(length, tmp_length);
1755 
1756   if (!start && (longlong) res->length() == length)
1757     return res;
1758   tmp_value.set(*res, (uint32) start, (uint32) length);
1759   return &tmp_value;
1760 }
1761 
1762 
1763 bool Item_func_substr::fix_length_and_dec()
1764 {
1765   max_length=args[0]->max_length;
1766 
1767   if (agg_arg_charsets_for_string_result(collation, args, 1))
1768     return TRUE;
1769   DBUG_ASSERT(collation.collation != NULL);
1770   if (args[1]->const_item())
1771   {
1772     int32 start= (int32) get_position();
1773     if (args[1]->null_value)
1774       max_length= 0;
1775     else if (start < 0)
1776       max_length= ((uint)(-start) > max_length) ? 0 : (uint)(-start);
1777     else
1778       max_length-= MY_MIN((uint)(start - 1), max_length);
1779   }
1780   if (arg_count == 3 && args[2]->const_item())
1781   {
1782     int32 length= (int32) args[2]->val_int();
1783     if (args[2]->null_value || length <= 0)
1784       max_length=0; /* purecov: inspected */
1785     else
1786       set_if_smaller(max_length,(uint) length);
1787   }
1788   max_length*= collation.collation->mbmaxlen;
1789   return FALSE;
1790 }
1791 
1792 
1793 bool Item_func_substr_index::fix_length_and_dec()
1794 {
1795   if (agg_arg_charsets_for_string_result_with_comparison(collation, args, 2))
1796     return TRUE;
1797   fix_char_length(args[0]->max_char_length());
1798   return FALSE;
1799 }
1800 
1801 
1802 String *Item_func_substr_index::val_str(String *str)
1803 {
1804   DBUG_ASSERT(fixed == 1);
1805   char buff[MAX_FIELD_WIDTH];
1806   String tmp(buff,sizeof(buff),system_charset_info);
1807   String *res= args[0]->val_str(&tmp_value);
1808   String *delimiter= args[1]->val_str(&tmp);
1809   int32 count= (int32) args[2]->val_int();
1810   uint offset;
1811 
1812   if (args[0]->null_value || args[1]->null_value || args[2]->null_value)
1813   {					// string and/or delim are null
1814     null_value=1;
1815     return 0;
1816   }
1817   null_value=0;
1818   uint delimiter_length= delimiter->length();
1819   if (!res->length() || !delimiter_length || !count)
1820     return make_empty_result();		// Wrong parameters
1821 
1822   res->set_charset(collation.collation);
1823 
1824 #ifdef USE_MB
1825   if (use_mb(res->charset()))
1826   {
1827     const char *ptr= res->ptr();
1828     const char *strend= ptr+res->length();
1829     const char *end= strend-delimiter_length+1;
1830     const char *search= delimiter->ptr();
1831     const char *search_end= search+delimiter_length;
1832     int32 n=0,c=count,pass;
1833     uint32 l;
1834     for (pass=(count>0);pass<2;++pass)
1835     {
1836       while (ptr < end)
1837       {
1838         if (*ptr == *search)
1839         {
1840 	  char *i,*j;
1841 	  i=(char*) ptr+1; j=(char*) search+1;
1842 	  while (j != search_end)
1843 	    if (*i++ != *j++) goto skip;
1844 	  if (pass==0) ++n;
1845 	  else if (!--c) break;
1846 	  ptr+= delimiter_length;
1847 	  continue;
1848 	}
1849     skip:
1850         if ((l=my_ismbchar(res->charset(), ptr,strend))) ptr+=l;
1851         else ++ptr;
1852       } /* either not found or got total number when count<0 */
1853       if (pass == 0) /* count<0 */
1854       {
1855         c+=n+1;
1856         if (c<=0)
1857         {
1858           str->copy(res->ptr(), res->length(), collation.collation);
1859           return str; // not found, return the original string
1860         }
1861         ptr=res->ptr();
1862       }
1863       else
1864       {
1865         if (c)
1866         {
1867           str->copy(res->ptr(), res->length(), collation.collation);
1868           return str; // not found, return the original string
1869         }
1870         if (count>0) /* return left part */
1871         {
1872           str->copy(res->ptr(), (uint32) (ptr-res->ptr()), collation.collation);
1873           return str;
1874         }
1875         else /* return right part */
1876         {
1877           ptr+= delimiter_length;
1878           str->copy(res->ptr() + (ptr-res->ptr()), (uint32) (strend - ptr),
1879                     collation.collation);
1880           return str;
1881         }
1882       }
1883     }
1884   }
1885   else
1886 #endif /* USE_MB */
1887   {
1888     if (count > 0)
1889     {					// start counting from the beginning
1890       for (offset=0; ; offset+= delimiter_length)
1891       {
1892         if ((int) (offset= res->strstr(*delimiter, offset)) < 0)
1893         {
1894           str->copy(res->ptr(), res->length(), collation.collation);
1895           return str; // not found, return the original string
1896         }
1897         if (!--count)
1898         {
1899           str->copy(res->ptr(), offset, collation.collation);
1900           return str;
1901         }
1902       }
1903     }
1904     else
1905     {
1906       /*
1907         Negative index, start counting at the end
1908       */
1909       for (offset=res->length(); offset ;)
1910       {
1911         /*
1912           this call will result in finding the position pointing to one
1913           address space less than where the found substring is located
1914           in res
1915         */
1916         if ((int) (offset= res->strrstr(*delimiter, offset)) < 0)
1917         {
1918           str->copy(res->ptr(), res->length(), collation.collation);
1919           return str; // not found, return the original string
1920         }
1921         /*
1922           At this point, we've searched for the substring
1923           the number of times as supplied by the index value
1924         */
1925         if (!++count)
1926         {
1927           offset+= delimiter_length;
1928           str->copy(res->ptr() + offset, res->length() - offset,
1929                     collation.collation);
1930           return str;
1931         }
1932       }
1933       if (count)
1934       {
1935         str->copy(res->ptr(), res->length(), collation.collation);
1936         return str; // not found, return the original string
1937       }
1938     }
1939   }
1940   DBUG_ASSERT(0);
1941   return NULL;
1942 }
1943 
1944 /*
1945 ** The trim functions are extension to ANSI SQL because they trim substrings
1946 ** They ltrim() and rtrim() functions are optimized for 1 byte strings
1947 ** They also return the original string if possible, else they return
1948 ** a substring that points at the original string.
1949 */
1950 
1951 
1952 String *Item_func_ltrim::val_str(String *str)
1953 {
1954   DBUG_ASSERT(fixed == 1);
1955   char buff[MAX_FIELD_WIDTH], *ptr, *end;
1956   String tmp(buff,sizeof(buff),system_charset_info);
1957   String *res, *remove_str;
1958   uint UNINIT_VAR(remove_length);
1959 
1960   res= args[0]->val_str(str);
1961   if ((null_value=args[0]->null_value))
1962     return 0;
1963   remove_str= &remove;                          /* Default value. */
1964   if (arg_count == 2)
1965   {
1966     remove_str= args[1]->val_str(&tmp);
1967     if ((null_value= args[1]->null_value))
1968       return 0;
1969   }
1970 
1971   if ((remove_length= remove_str->length()) == 0 ||
1972       remove_length > res->length())
1973     return non_trimmed_value(res);
1974 
1975   ptr= (char*) res->ptr();
1976   end= ptr+res->length();
1977   if (remove_length == 1)
1978   {
1979     char chr=(*remove_str)[0];
1980     while (ptr != end && *ptr == chr)
1981       ptr++;
1982   }
1983   else
1984   {
1985     const char *r_ptr=remove_str->ptr();
1986     end-=remove_length;
1987     while (ptr <= end && !memcmp(ptr, r_ptr, remove_length))
1988       ptr+=remove_length;
1989     end+=remove_length;
1990   }
1991   if (ptr == res->ptr())
1992     return non_trimmed_value(res);
1993   return trimmed_value(res, (uint32) (ptr - res->ptr()), (uint32) (end - ptr));
1994 }
1995 
1996 
1997 String *Item_func_rtrim::val_str(String *str)
1998 {
1999   DBUG_ASSERT(fixed == 1);
2000   char buff[MAX_FIELD_WIDTH], *ptr, *end;
2001   String tmp(buff, sizeof(buff), system_charset_info);
2002   String *res, *remove_str;
2003   uint UNINIT_VAR(remove_length);
2004 
2005   res= args[0]->val_str(str);
2006   if ((null_value=args[0]->null_value))
2007     return 0;
2008   remove_str= &remove;                          /* Default value. */
2009   if (arg_count == 2)
2010   {
2011     remove_str= args[1]->val_str(&tmp);
2012     if ((null_value= args[1]->null_value))
2013       return 0;
2014   }
2015 
2016   if ((remove_length= remove_str->length()) == 0 ||
2017       remove_length > res->length())
2018     return non_trimmed_value(res);
2019 
2020   ptr= (char*) res->ptr();
2021   end= ptr+res->length();
2022 #ifdef USE_MB
2023   char *p=ptr;
2024   uint32 l;
2025 #endif
2026   if (remove_length == 1)
2027   {
2028     char chr=(*remove_str)[0];
2029 #ifdef USE_MB
2030     if (use_mb(collation.collation))
2031     {
2032       while (ptr < end)
2033       {
2034 	if ((l= my_ismbchar(collation.collation, ptr, end))) ptr+= l, p=ptr;
2035 	else ++ptr;
2036       }
2037       ptr=p;
2038     }
2039 #endif
2040     while (ptr != end  && end[-1] == chr)
2041       end--;
2042   }
2043   else
2044   {
2045     const char *r_ptr=remove_str->ptr();
2046 #ifdef USE_MB
2047     if (use_mb(collation.collation))
2048     {
2049   loop:
2050       while (ptr + remove_length < end)
2051       {
2052 	if ((l= my_ismbchar(collation.collation, ptr, end))) ptr+= l;
2053 	else ++ptr;
2054       }
2055       if (ptr + remove_length == end && !memcmp(ptr,r_ptr,remove_length))
2056       {
2057 	end-=remove_length;
2058 	ptr=p;
2059 	goto loop;
2060       }
2061     }
2062     else
2063 #endif /* USE_MB */
2064     {
2065       while (ptr + remove_length <= end &&
2066 	     !memcmp(end-remove_length, r_ptr, remove_length))
2067 	end-=remove_length;
2068     }
2069   }
2070   if (end == res->ptr()+res->length())
2071     return non_trimmed_value(res);
2072   return trimmed_value(res, 0, (uint32) (end - res->ptr()));
2073 }
2074 
2075 
2076 String *Item_func_trim::val_str(String *str)
2077 {
2078   DBUG_ASSERT(fixed == 1);
2079   char buff[MAX_FIELD_WIDTH], *ptr, *end;
2080   const char *r_ptr;
2081   String tmp(buff, sizeof(buff), system_charset_info);
2082   String *res, *remove_str;
2083   uint UNINIT_VAR(remove_length);
2084 
2085   res= args[0]->val_str(str);
2086   if ((null_value=args[0]->null_value))
2087     return 0;
2088   remove_str= &remove;                          /* Default value. */
2089   if (arg_count == 2)
2090   {
2091     remove_str= args[1]->val_str(&tmp);
2092     if ((null_value= args[1]->null_value))
2093       return 0;
2094   }
2095 
2096   if ((remove_length= remove_str->length()) == 0 ||
2097       remove_length > res->length())
2098     return non_trimmed_value(res);
2099 
2100   ptr= (char*) res->ptr();
2101   end= ptr+res->length();
2102   r_ptr= remove_str->ptr();
2103   while (ptr+remove_length <= end && !memcmp(ptr,r_ptr,remove_length))
2104     ptr+=remove_length;
2105 #ifdef USE_MB
2106   if (use_mb(collation.collation))
2107   {
2108     char *p=ptr;
2109     uint32 l;
2110  loop:
2111     while (ptr + remove_length < end)
2112     {
2113       if ((l= my_ismbchar(collation.collation, ptr, end)))
2114         ptr+= l;
2115       else
2116         ++ptr;
2117     }
2118     if (ptr + remove_length == end && !memcmp(ptr,r_ptr,remove_length))
2119     {
2120       end-=remove_length;
2121       ptr=p;
2122       goto loop;
2123     }
2124     ptr=p;
2125   }
2126   else
2127 #endif /* USE_MB */
2128   {
2129     while (ptr + remove_length <= end &&
2130 	   !memcmp(end-remove_length,r_ptr,remove_length))
2131       end-=remove_length;
2132   }
2133   if (ptr == res->ptr() && end == ptr+res->length())
2134     return non_trimmed_value(res);
2135   return trimmed_value(res, (uint32) (ptr - res->ptr()), (uint32) (end - ptr));
2136 }
2137 
2138 bool Item_func_trim::fix_length_and_dec()
2139 {
2140   if (arg_count == 1)
2141   {
2142     if (agg_arg_charsets_for_string_result(collation, args, 1))
2143       return TRUE;
2144     DBUG_ASSERT(collation.collation != NULL);
2145     remove.set_charset(collation.collation);
2146     remove.set_ascii(" ",1);
2147   }
2148   else
2149   {
2150     // Handle character set for args[1] and args[0].
2151     // Note that we pass args[1] as the first item, and args[0] as the second.
2152     if (agg_arg_charsets_for_string_result_with_comparison(collation,
2153                                                            &args[1], 2, -1))
2154       return TRUE;
2155   }
2156   fix_char_length(args[0]->max_char_length());
2157   return FALSE;
2158 }
2159 
2160 void Item_func_trim::print(String *str, enum_query_type query_type)
2161 {
2162   if (arg_count == 1)
2163   {
2164     Item_func::print(str, query_type);
2165     return;
2166   }
2167   str->append(Item_func_trim::func_name());
2168   str->append(func_name_ext());
2169   str->append('(');
2170   str->append(mode_name());
2171   str->append(' ');
2172   args[1]->print(str, query_type);
2173   str->append(STRING_WITH_LEN(" from "));
2174   args[0]->print(str, query_type);
2175   str->append(')');
2176 }
2177 
2178 
2179 /*
2180   RTRIM(expr)
2181   TRIM(TRAILING ' ' FROM expr)
2182   remove argument's soft dependency on PAD_CHAR_TO_FULL_LENGTH:
2183 */
2184 Sql_mode_dependency Item_func_trim::value_depends_on_sql_mode() const
2185 {
2186   DBUG_ASSERT(fixed);
2187   if (arg_count == 1) // RTRIM(expr)
2188     return (args[0]->value_depends_on_sql_mode() &
2189             Sql_mode_dependency(~0, ~MODE_PAD_CHAR_TO_FULL_LENGTH)).
2190            soft_to_hard();
2191   // TRIM(... FROM expr)
2192   DBUG_ASSERT(arg_count == 2);
2193   if (!args[1]->value_depends_on_sql_mode_const_item())
2194     return Item_func::value_depends_on_sql_mode();
2195   StringBuffer<64> trimstrbuf;
2196   String *trimstr= args[1]->val_str(&trimstrbuf);
2197   if (!trimstr)
2198     return Sql_mode_dependency();                  // will return NULL
2199   if (trimstr->length() == 0)
2200     return Item_func::value_depends_on_sql_mode(); // will trim nothing
2201   if (trimstr->lengthsp() != 0)
2202     return Item_func::value_depends_on_sql_mode(); // will trim not only spaces
2203   if (trimstr->length() > trimstr->charset()->mbminlen ||
2204       trimstr->numchars() > 1)
2205     return Item_func::value_depends_on_sql_mode(); // more than one space
2206   // TRIM(TRAILING ' ' FROM expr)
2207   return ((args[0]->value_depends_on_sql_mode() |
2208            args[1]->value_depends_on_sql_mode()) &
2209           Sql_mode_dependency(~0, ~MODE_PAD_CHAR_TO_FULL_LENGTH)).
2210          soft_to_hard();
2211 }
2212 
2213 
2214 /* Item_func_password */
2215 
2216 bool Item_func_password::fix_fields(THD *thd, Item **ref)
2217 {
2218   if (deflt)
2219     alg= (thd->variables.old_passwords ? OLD : NEW);
2220   return Item_str_ascii_func::fix_fields(thd, ref);
2221 }
2222 
2223 String *Item_func_password::val_str_ascii(String *str)
2224 {
2225   DBUG_ASSERT(fixed == 1);
2226   String *res= args[0]->val_str(str);
2227   switch (alg){
2228   case NEW:
2229     if (args[0]->null_value || res->length() == 0)
2230       return make_empty_result();
2231     my_make_scrambled_password(tmp_value, res->ptr(), res->length());
2232     str->set(tmp_value, SCRAMBLED_PASSWORD_CHAR_LENGTH, &my_charset_latin1);
2233     break;
2234   case OLD:
2235     if ((null_value=args[0]->null_value))
2236       return 0;
2237     if (res->length() == 0)
2238       return make_empty_result();
2239     my_make_scrambled_password_323(tmp_value, res->ptr(), res->length());
2240     str->set(tmp_value, SCRAMBLED_PASSWORD_CHAR_LENGTH_323, &my_charset_latin1);
2241     break;
2242   default:
2243     DBUG_ASSERT(0);
2244   }
2245   return str;
2246 }
2247 
2248 char *Item_func_password::alloc(THD *thd, const char *password,
2249                                 size_t pass_len, enum PW_Alg al)
2250 {
2251   char *buff= (char *) thd->alloc((al==NEW)?
2252                                   SCRAMBLED_PASSWORD_CHAR_LENGTH + 1:
2253                                   SCRAMBLED_PASSWORD_CHAR_LENGTH_323 + 1);
2254   if (!buff)
2255     return NULL;
2256 
2257   switch (al) {
2258   case NEW:
2259     my_make_scrambled_password(buff, password, pass_len);
2260     break;
2261   case OLD:
2262     my_make_scrambled_password_323(buff, password, pass_len);
2263     break;
2264   default:
2265     DBUG_ASSERT(0);
2266   }
2267   return buff;
2268 }
2269 
2270 
2271 
2272 #define bin_to_ascii(c) ((c)>=38?((c)-38+'a'):(c)>=12?((c)-12+'A'):(c)+'.')
2273 
2274 String *Item_func_encrypt::val_str(String *str)
2275 {
2276   DBUG_ASSERT(fixed == 1);
2277 
2278 #ifdef HAVE_CRYPT
2279   String *res  =args[0]->val_str(str);
2280 
2281   char salt[3],*salt_ptr;
2282   if ((null_value=args[0]->null_value))
2283     return 0;
2284   if (res->length() == 0)
2285     return make_empty_result();
2286   if (arg_count == 1)
2287   {					// generate random salt
2288     time_t timestamp=current_thd->query_start();
2289     salt[0] = bin_to_ascii( (ulong) timestamp & 0x3f);
2290     salt[1] = bin_to_ascii(( (ulong) timestamp >> 5) & 0x3f);
2291     salt[2] = 0;
2292     salt_ptr=salt;
2293   }
2294   else
2295   {					// obtain salt from the first two bytes
2296     String *salt_str=args[1]->val_str(&tmp_value);
2297     if ((null_value= (args[1]->null_value || salt_str->length() < 2)))
2298       return 0;
2299     salt_ptr= salt_str->c_ptr_safe();
2300   }
2301   mysql_mutex_lock(&LOCK_crypt);
2302   char *tmp= crypt(res->c_ptr_safe(),salt_ptr);
2303   if (!tmp)
2304   {
2305     mysql_mutex_unlock(&LOCK_crypt);
2306     null_value= 1;
2307     return 0;
2308   }
2309   str->set(tmp, (uint) strlen(tmp), &my_charset_bin);
2310   str->copy();
2311   mysql_mutex_unlock(&LOCK_crypt);
2312   return str;
2313 #else
2314   null_value=1;
2315   return 0;
2316 #endif	/* HAVE_CRYPT */
2317 }
2318 
2319 bool Item_func_encode::seed()
2320 {
2321   char buf[80];
2322   ulong rand_nr[2];
2323   String *key, tmp(buf, sizeof(buf), system_charset_info);
2324 
2325   if (!(key= args[1]->val_str(&tmp)))
2326     return TRUE;
2327 
2328   hash_password(rand_nr, key->ptr(), key->length());
2329   sql_crypt.init(rand_nr);
2330 
2331   return FALSE;
2332 }
2333 
2334 bool Item_func_encode::fix_length_and_dec()
2335 {
2336   max_length=args[0]->max_length;
2337   maybe_null=args[0]->maybe_null || args[1]->maybe_null;
2338   collation.set(&my_charset_bin);
2339   /* Precompute the seed state if the item is constant. */
2340   seeded= args[1]->const_item() &&
2341           (args[1]->result_type() == STRING_RESULT) && !seed();
2342   return FALSE;
2343 }
2344 
2345 String *Item_func_encode::val_str(String *str)
2346 {
2347   String *res;
2348   DBUG_ASSERT(fixed == 1);
2349 
2350   if (!(res=args[0]->val_str(str)))
2351   {
2352     null_value= 1;
2353     return NULL;
2354   }
2355 
2356   if (!seeded && seed())
2357   {
2358     null_value= 1;
2359     return NULL;
2360   }
2361 
2362   null_value= 0;
2363   res= copy_if_not_alloced(str, res, res->length());
2364   crypto_transform(res);
2365   sql_crypt.reinit();
2366 
2367   return res;
2368 }
2369 
2370 void Item_func_encode::crypto_transform(String *res)
2371 {
2372   sql_crypt.encode((char*) res->ptr(),res->length());
2373   res->set_charset(&my_charset_bin);
2374 }
2375 
2376 void Item_func_decode::crypto_transform(String *res)
2377 {
2378   sql_crypt.decode((char*) res->ptr(),res->length());
2379 }
2380 
2381 
2382 String *Item_func_database::val_str(String *str)
2383 {
2384   DBUG_ASSERT(fixed == 1);
2385   THD *thd= current_thd;
2386   if (thd->db.str == NULL)
2387   {
2388     null_value= 1;
2389     return 0;
2390   }
2391   else
2392     str->copy(thd->db.str, thd->db.length, system_charset_info);
2393   null_value= 0;
2394   return str;
2395 }
2396 
2397 
2398 String *Item_func_sqlerrm::val_str(String *str)
2399 {
2400   DBUG_ASSERT(fixed);
2401   DBUG_ASSERT(!null_value);
2402   Diagnostics_area::Sql_condition_iterator it=
2403     current_thd->get_stmt_da()->sql_conditions();
2404   const Sql_condition *err;
2405   if ((err= it++))
2406   {
2407     str->copy(err->get_message_text(), err->get_message_octet_length(),
2408               system_charset_info);
2409     return str;
2410   }
2411   str->copy(STRING_WITH_LEN("normal, successful completion"),
2412             system_charset_info);
2413   return str;
2414 }
2415 
2416 
2417 /**
2418   @note USER() is replicated correctly if binlog_format=ROW or (as of
2419   BUG#28086) binlog_format=MIXED, but is incorrectly replicated to ''
2420   if binlog_format=STATEMENT.
2421 */
2422 bool Item_func_user::init(const char *user, const char *host)
2423 {
2424   DBUG_ASSERT(fixed == 1);
2425 
2426   // For system threads (e.g. replication SQL thread) user may be empty
2427   if (user)
2428   {
2429     CHARSET_INFO *cs= str_value.charset();
2430     size_t res_length= (strlen(user)+strlen(host)+2) * cs->mbmaxlen;
2431 
2432     if (str_value.alloc((uint) res_length))
2433     {
2434       null_value=1;
2435       return TRUE;
2436     }
2437 
2438     res_length=cs->cset->snprintf(cs, (char*)str_value.ptr(), (uint) res_length,
2439                                   "%s@%s", user, host);
2440     str_value.length((uint) res_length);
2441     str_value.mark_as_const();
2442   }
2443   return FALSE;
2444 }
2445 
2446 
2447 Item *Item_func_sysconst::safe_charset_converter(THD *thd, CHARSET_INFO *tocs)
2448 {
2449   /*
2450    During view or prepared statement creation, the item should not
2451    make use of const_charset_converter as it would imply substitution
2452    with constant items which is not correct. Functions can have different
2453    values during view creation and view execution based on context.
2454 
2455    Return the identical item during view creation and prepare.
2456   */
2457   if (thd->lex->is_ps_or_view_context_analysis())
2458     return this;
2459   return const_charset_converter(thd, tocs, true, fully_qualified_func_name());
2460 }
2461 
2462 bool Item_func_sysconst::const_item() const
2463 {
2464   if (current_thd->lex->is_ps_or_view_context_analysis())
2465     return false;
2466   return true;
2467 }
2468 
2469 bool Item_func_user::fix_fields(THD *thd, Item **ref)
2470 {
2471   return (Item_func_sysconst::fix_fields(thd, ref) ||
2472           init(thd->main_security_ctx.user,
2473                thd->main_security_ctx.host_or_ip));
2474 }
2475 
2476 
2477 bool Item_func_current_user::fix_fields(THD *thd, Item **ref)
2478 {
2479   if (Item_func_sysconst::fix_fields(thd, ref))
2480     return TRUE;
2481 
2482   Security_context *ctx= context && context->security_ctx
2483                           ? context->security_ctx : thd->security_ctx;
2484   return init(ctx->priv_user, ctx->priv_host);
2485 }
2486 
2487 bool Item_func_current_role::fix_fields(THD *thd, Item **ref)
2488 {
2489   if (Item_func_sysconst::fix_fields(thd, ref))
2490     return 1;
2491 
2492   Security_context *ctx= context && context->security_ctx
2493                           ? context->security_ctx : thd->security_ctx;
2494   if (ctx->priv_role[0])
2495   {
2496     if (str_value.copy(ctx->priv_role, strlen(ctx->priv_role),
2497                        system_charset_info))
2498       return 1;
2499     str_value.mark_as_const();
2500     null_value= maybe_null= 0;
2501     return 0;
2502   }
2503   null_value= maybe_null= 1;
2504   return 0;
2505 }
2506 
2507 bool Item_func_soundex::fix_length_and_dec()
2508 {
2509   uint32 char_length= args[0]->max_char_length();
2510   if (agg_arg_charsets_for_string_result(collation, args, 1))
2511     return TRUE;
2512   DBUG_ASSERT(collation.collation != NULL);
2513   set_if_bigger(char_length, 4);
2514   fix_char_length(char_length);
2515   return FALSE;
2516 }
2517 
2518 
2519 /**
2520   If alpha, map input letter to soundex code.
2521   If not alpha and remove_garbage is set then skip to next char
2522   else return 0
2523 */
2524 
2525 static int soundex_toupper(int ch)
2526 {
2527   return (ch >= 'a' && ch <= 'z') ? ch - 'a' + 'A' : ch;
2528 }
2529 
2530 
2531 static char get_scode(int wc)
2532 {
2533   int ch= soundex_toupper(wc);
2534   if (ch < 'A' || ch > 'Z')
2535   {
2536 					// Thread extended alfa (country spec)
2537     return '0';				// as vokal
2538   }
2539   return(soundex_map[ch-'A']);
2540 }
2541 
2542 
2543 static bool my_uni_isalpha(int wc)
2544 {
2545   /*
2546     Return true for all Basic Latin letters: a..z A..Z.
2547     Return true for all Unicode characters with code higher than U+00C0:
2548     - characters between 'z' and U+00C0 are controls and punctuations.
2549     - "U+00C0 LATIN CAPITAL LETTER A WITH GRAVE" is the first letter after 'z'.
2550   */
2551   return (wc >= 'a' && wc <= 'z') ||
2552          (wc >= 'A' && wc <= 'Z') ||
2553          (wc >= 0xC0);
2554 }
2555 
2556 
2557 String *Item_func_soundex::val_str(String *str)
2558 {
2559   DBUG_ASSERT(fixed == 1);
2560   String *res= args[0]->val_str(&tmp_value);
2561   char last_ch,ch;
2562   CHARSET_INFO *cs= collation.collation;
2563   my_wc_t wc;
2564   uint nchars;
2565   int rc;
2566 
2567   if ((null_value= args[0]->null_value))
2568     return 0; /* purecov: inspected */
2569 
2570   if (str->alloc(MY_MAX(res->length(), 4 * cs->mbminlen)))
2571     return &tmp_value; /* purecov: inspected */
2572   str->set_charset(collation.collation);
2573   char *to= (char *) str->ptr();
2574   char *to_end= to + str->alloced_length();
2575   char *from= (char *) res->ptr(), *end= from + res->length();
2576 
2577   for ( ; ; ) /* Skip pre-space */
2578   {
2579     if ((rc= cs->cset->mb_wc(cs, &wc, (uchar*) from, (uchar*) end)) <= 0)
2580       return make_empty_result(); /* EOL or invalid byte sequence */
2581 
2582     if (rc == 1 && cs->ctype)
2583     {
2584       /* Single byte letter found */
2585       if (my_isalpha(cs, *from))
2586       {
2587         last_ch= get_scode(*from);       // Code of the first letter
2588         *to++= soundex_toupper(*from++); // Copy first letter
2589         break;
2590       }
2591       from++;
2592     }
2593     else
2594     {
2595       from+= rc;
2596       if (my_uni_isalpha(wc))
2597       {
2598         /* Multibyte letter found */
2599         wc= soundex_toupper(wc);
2600         last_ch= get_scode(wc);     // Code of the first letter
2601         if ((rc= cs->cset->wc_mb(cs, wc, (uchar*) to, (uchar*) to_end)) <= 0)
2602         {
2603           /* Extra safety - should not really happen */
2604           DBUG_ASSERT(false);
2605           return make_empty_result();
2606         }
2607         to+= rc;
2608         break;
2609       }
2610     }
2611   }
2612 
2613   /*
2614      last_ch is now set to the first 'double-letter' check.
2615      loop on input letters until end of input
2616   */
2617   for (nchars= 1 ; ; )
2618   {
2619     if ((rc= cs->cset->mb_wc(cs, &wc, (uchar*) from, (uchar*) end)) <= 0)
2620       break; /* EOL or invalid byte sequence */
2621 
2622     if (rc == 1 && cs->ctype)
2623     {
2624       if (!my_isalpha(cs, *from++))
2625         continue;
2626     }
2627     else
2628     {
2629       from+= rc;
2630       if (!my_uni_isalpha(wc))
2631         continue;
2632     }
2633 
2634     ch= get_scode(wc);
2635     if ((ch != '0') && (ch != last_ch)) // if not skipped or double
2636     {
2637       // letter, copy to output
2638       if ((rc= cs->cset->wc_mb(cs, (my_wc_t) ch,
2639                                (uchar*) to, (uchar*) to_end)) <= 0)
2640       {
2641         // Extra safety - should not really happen
2642         DBUG_ASSERT(false);
2643         break;
2644       }
2645       to+= rc;
2646       nchars++;
2647       last_ch= ch;  // save code of last input letter
2648     }               // for next double-letter check
2649   }
2650 
2651   /* Pad up to 4 characters with DIGIT ZERO, if the string is shorter */
2652   if (nchars < 4)
2653   {
2654     uint nbytes= (4 - nchars) * cs->mbminlen;
2655     cs->cset->fill(cs, to, nbytes, '0');
2656     to+= nbytes;
2657   }
2658 
2659   str->length((uint) (to - str->ptr()));
2660   return str;
2661 }
2662 
2663 
2664 /**
2665   Change a number to format '3,333,333,333.000'.
2666 
2667   This should be 'internationalized' sometimes.
2668 */
2669 
2670 const int FORMAT_MAX_DECIMALS= 30;
2671 
2672 
2673 bool Item_func_format::fix_length_and_dec()
2674 {
2675   uint32 char_length= args[0]->max_char_length();
2676   uint32 max_sep_count= (char_length / 3) + (decimals ? 1 : 0) + /*sign*/1;
2677   collation.set(default_charset());
2678   fix_char_length(char_length + max_sep_count + decimals);
2679   if (arg_count == 3)
2680     locale= args[2]->basic_const_item() ? args[2]->locale_from_val_str() : NULL;
2681   else
2682     locale= &my_locale_en_US; /* Two arguments */
2683   return FALSE;
2684 }
2685 
2686 
2687 /**
2688   @todo
2689   This needs to be fixed for multi-byte character set where numbers
2690   are stored in more than one byte
2691 */
2692 
2693 String *Item_func_format::val_str_ascii(String *str)
2694 {
2695   uint32 str_length;
2696   /* Number of decimal digits */
2697   int dec;
2698   /* Number of characters used to represent the decimals, including '.' */
2699   uint32 dec_length;
2700   const MY_LOCALE *lc;
2701   DBUG_ASSERT(fixed == 1);
2702 
2703   dec= (int) args[1]->val_int();
2704   if (args[1]->null_value)
2705   {
2706     null_value=1;
2707     return NULL;
2708   }
2709 
2710   lc= locale ? locale : args[2]->locale_from_val_str();
2711 
2712   dec= set_zone(dec, 0, FORMAT_MAX_DECIMALS);
2713   dec_length= dec ? dec+1 : 0;
2714   null_value=0;
2715 
2716   if (args[0]->result_type() == DECIMAL_RESULT ||
2717       args[0]->result_type() == INT_RESULT)
2718   {
2719     my_decimal dec_val, rnd_dec, *res;
2720     res= args[0]->val_decimal(&dec_val);
2721     if ((null_value=args[0]->null_value))
2722       return 0; /* purecov: inspected */
2723     my_decimal_round(E_DEC_FATAL_ERROR, res, dec, false, &rnd_dec);
2724     my_decimal2string(E_DEC_FATAL_ERROR, &rnd_dec, 0, 0, 0, str);
2725     str_length= str->length();
2726   }
2727   else
2728   {
2729     double nr= args[0]->val_real();
2730     if ((null_value=args[0]->null_value))
2731       return 0; /* purecov: inspected */
2732     nr= my_double_round(nr, (longlong) dec, FALSE, FALSE);
2733     str->set_real(nr, dec, &my_charset_numeric);
2734     if (!std::isfinite(nr))
2735       return str;
2736     str_length=str->length();
2737   }
2738   /* We need this test to handle 'nan' and short values */
2739   if (lc->grouping[0] > 0 &&
2740       str_length >= dec_length + 1 + lc->grouping[0])
2741   {
2742     /* We need space for ',' between each group of digits as well. */
2743     char buf[2 * FLOATING_POINT_BUFFER];
2744     int count;
2745     const char *grouping= lc->grouping;
2746     char sign_length= *str->ptr() == '-' ? 1 : 0;
2747     const char *src= str->ptr() + str_length - dec_length - 1;
2748     const char *src_begin= str->ptr() + sign_length;
2749     char *dst= buf + sizeof(buf);
2750 
2751     /* Put the fractional part */
2752     if (dec)
2753     {
2754       dst-= (dec + 1);
2755       *dst= lc->decimal_point;
2756       memcpy(dst + 1, src + 2, dec);
2757     }
2758 
2759     /* Put the integer part with grouping */
2760     for (count= *grouping; src >= src_begin; count--)
2761     {
2762       /*
2763         When *grouping==0x80 (which means "end of grouping")
2764         count will be initialized to -1 and
2765         we'll never get into this "if" anymore.
2766       */
2767       if (count == 0)
2768       {
2769         *--dst= lc->thousand_sep;
2770         if (grouping[1])
2771           grouping++;
2772         count= *grouping;
2773       }
2774       DBUG_ASSERT(dst > buf);
2775       *--dst= *src--;
2776     }
2777 
2778     if (sign_length) /* Put '-' */
2779       *--dst= *str->ptr();
2780 
2781     /* Put the rest of the integer part without grouping */
2782     str->copy(dst, buf + sizeof(buf) - dst, &my_charset_latin1);
2783   }
2784   else if (dec_length && lc->decimal_point != '.')
2785   {
2786     /*
2787       For short values without thousands (<1000)
2788       replace decimal point to localized value.
2789     */
2790     DBUG_ASSERT(dec_length <= str_length);
2791     ((char*) str->ptr())[str_length - dec_length]= lc->decimal_point;
2792   }
2793   return str;
2794 }
2795 
2796 
2797 bool Item_func_elt::fix_length_and_dec()
2798 {
2799   uint32 char_length= 0;
2800   decimals=0;
2801 
2802   if (agg_arg_charsets_for_string_result(collation, args + 1, arg_count - 1))
2803     return TRUE;
2804 
2805   for (uint i= 1 ; i < arg_count ; i++)
2806   {
2807     set_if_bigger(char_length, args[i]->max_char_length());
2808     set_if_bigger(decimals,args[i]->decimals);
2809   }
2810   fix_char_length(char_length);
2811   maybe_null=1;					// NULL if wrong first arg
2812   return FALSE;
2813 }
2814 
2815 
2816 double Item_func_elt::val_real()
2817 {
2818   DBUG_ASSERT(fixed == 1);
2819   uint tmp;
2820   null_value=1;
2821   if ((tmp=(uint) args[0]->val_int()) == 0 || tmp >= arg_count)
2822     return 0.0;
2823   double result= args[tmp]->val_real();
2824   null_value= args[tmp]->null_value;
2825   return result;
2826 }
2827 
2828 
2829 longlong Item_func_elt::val_int()
2830 {
2831   DBUG_ASSERT(fixed == 1);
2832   uint tmp;
2833   null_value=1;
2834   if ((tmp=(uint) args[0]->val_int()) == 0 || tmp >= arg_count)
2835     return 0;
2836 
2837   longlong result= args[tmp]->val_int();
2838   null_value= args[tmp]->null_value;
2839   return result;
2840 }
2841 
2842 
2843 String *Item_func_elt::val_str(String *str)
2844 {
2845   DBUG_ASSERT(fixed == 1);
2846   uint tmp;
2847   null_value=1;
2848   if ((tmp=(uint) args[0]->val_int()) == 0 || tmp >= arg_count)
2849     return NULL;
2850 
2851   String *result= args[tmp]->val_str(str);
2852   if (result)
2853     result->set_charset(collation.collation);
2854   null_value= args[tmp]->null_value;
2855   return result;
2856 }
2857 
2858 
2859 bool Item_func_make_set::fix_length_and_dec()
2860 {
2861   uint32 char_length= arg_count - 2; /* Separators */
2862 
2863   if (agg_arg_charsets_for_string_result(collation, args + 1, arg_count - 1))
2864     return TRUE;
2865 
2866   for (uint i=1 ; i < arg_count ; i++)
2867     char_length+= args[i]->max_char_length();
2868   fix_char_length(char_length);
2869   return FALSE;
2870 }
2871 
2872 
2873 String *Item_func_make_set::val_str(String *str)
2874 {
2875   DBUG_ASSERT(fixed == 1);
2876   ulonglong bits;
2877   bool first_found=0;
2878   Item **ptr=args+1;
2879   String *result= make_empty_result();
2880 
2881   bits=args[0]->val_int();
2882   if ((null_value=args[0]->null_value))
2883     return NULL;
2884 
2885   if (arg_count < 65)
2886     bits &= ((ulonglong) 1 << (arg_count-1))-1;
2887 
2888   for (; bits; bits >>= 1, ptr++)
2889   {
2890     if (bits & 1)
2891     {
2892       String *res= (*ptr)->val_str(str);
2893       if (res)					// Skip nulls
2894       {
2895 	if (!first_found)
2896 	{					// First argument
2897 	  first_found=1;
2898 	  if (res != str)
2899 	    result=res;				// Use original string
2900 	  else
2901 	  {
2902 	    if (tmp_str.copy(*res))		// Don't use 'str'
2903               return make_empty_result();
2904 	    result= &tmp_str;
2905 	  }
2906 	}
2907 	else
2908 	{
2909 	  if (result != &tmp_str)
2910 	  {					// Copy data to tmp_str
2911 	    if (tmp_str.alloc(result->length()+res->length()+1) ||
2912 		tmp_str.copy(*result))
2913               return make_empty_result();
2914 	    result= &tmp_str;
2915 	  }
2916 	  if (tmp_str.append(STRING_WITH_LEN(","), &my_charset_bin) || tmp_str.append(*res))
2917             return make_empty_result();
2918 	}
2919       }
2920     }
2921   }
2922   return result;
2923 }
2924 
2925 
2926 void Item_func_char::print(String *str, enum_query_type query_type)
2927 {
2928   str->append(Item_func_char::func_name());
2929   str->append('(');
2930   print_args(str, 0, query_type);
2931   if (collation.collation != &my_charset_bin)
2932   {
2933     str->append(STRING_WITH_LEN(" using "));
2934     str->append(collation.collation->csname);
2935   }
2936   str->append(')');
2937 }
2938 
2939 
2940 String *Item_func_char::val_str(String *str)
2941 {
2942   DBUG_ASSERT(fixed == 1);
2943   str->length(0);
2944   str->set_charset(collation.collation);
2945   for (uint i=0 ; i < arg_count ; i++)
2946   {
2947     int32 num=(int32) args[i]->val_int();
2948     if (!args[i]->null_value)
2949       append_char(str, num);
2950   }
2951   str->realloc(str->length());			// Add end 0 (for Purify)
2952   return check_well_formed_result(str);
2953 }
2954 
2955 
2956 void Item_func_char::append_char(String *str, int32 num)
2957 {
2958   char tmp[4];
2959   if (num & 0xFF000000L)
2960   {
2961     mi_int4store(tmp, num);
2962     str->append(tmp, 4, &my_charset_bin);
2963   }
2964   else if (num & 0xFF0000L)
2965   {
2966     mi_int3store(tmp, num);
2967     str->append(tmp, 3, &my_charset_bin);
2968   }
2969   else if (num & 0xFF00L)
2970   {
2971     mi_int2store(tmp, num);
2972     str->append(tmp, 2, &my_charset_bin);
2973   }
2974   else
2975   {
2976     tmp[0]= (char) num;
2977     str->append(tmp, 1, &my_charset_bin);
2978   }
2979 }
2980 
2981 
2982 String *Item_func_chr::val_str(String *str)
2983 {
2984   DBUG_ASSERT(fixed == 1);
2985   str->length(0);
2986   str->set_charset(collation.collation);
2987   int32 num=(int32) args[0]->val_int();
2988   if (!args[0]->null_value)
2989     append_char(str, num);
2990   else
2991   {
2992     null_value= 1;
2993     return 0;
2994   }
2995   str->realloc(str->length());			// Add end 0 (for Purify)
2996   return check_well_formed_result(str);
2997 }
2998 
2999 
3000 inline String* alloc_buffer(String *res,String *str,String *tmp_value,
3001 			    ulong length)
3002 {
3003   if (res->alloced_length() < length)
3004   {
3005     if (str->alloced_length() >= length)
3006     {
3007       (void) str->copy(*res);
3008       str->length(length);
3009       return str;
3010     }
3011     if (tmp_value->alloc(length))
3012       return 0;
3013     (void) tmp_value->copy(*res);
3014     tmp_value->length(length);
3015     return tmp_value;
3016   }
3017   res->length(length);
3018   return res;
3019 }
3020 
3021 
3022 bool Item_func_repeat::fix_length_and_dec()
3023 {
3024   if (agg_arg_charsets_for_string_result(collation, args, 1))
3025     return TRUE;
3026   DBUG_ASSERT(collation.collation != NULL);
3027   if (args[1]->const_item() && !args[1]->is_expensive())
3028   {
3029     Repeat_count tmp(args[1]);
3030     ulonglong char_length= (ulonglong) args[0]->max_char_length() * tmp.count();
3031     fix_char_length_ulonglong(char_length);
3032     return false;
3033   }
3034   max_length= MAX_BLOB_WIDTH;
3035   maybe_null= true;
3036   return false;
3037 }
3038 
3039 /**
3040   Item_func_repeat::str is carefully written to avoid reallocs
3041   as much as possible at the cost of a local buffer
3042 */
3043 
3044 String *Item_func_repeat::val_str(String *str)
3045 {
3046   DBUG_ASSERT(fixed == 1);
3047   uint length,tot_length;
3048   char *to;
3049   /* must be longlong to avoid truncation */
3050   longlong count= args[1]->val_int();
3051   String *res= args[0]->val_str(str);
3052 
3053   if (args[0]->null_value || args[1]->null_value)
3054     goto err;				// string and/or delim are null
3055   null_value= 0;
3056 
3057   if (count <= 0 && (count == 0 || !args[1]->unsigned_flag))
3058     return make_empty_result();
3059 
3060   /* Assumes that the maximum length of a String is < INT_MAX32. */
3061   /* Bounds check on count:  If this is triggered, we will error. */
3062   if ((ulonglong) count > INT_MAX32)
3063     count= INT_MAX32;
3064   if (count == 1)			// To avoid reallocs
3065     return res;
3066   length=res->length();
3067 
3068   // Safe length check
3069   {
3070     THD *thd= current_thd;
3071     if (length > thd->variables.max_allowed_packet / (uint) count)
3072     {
3073       push_warning_printf(thd, Sql_condition::WARN_LEVEL_WARN,
3074                           ER_WARN_ALLOWED_PACKET_OVERFLOWED,
3075                           ER_THD(thd, ER_WARN_ALLOWED_PACKET_OVERFLOWED),
3076                           func_name(), thd->variables.max_allowed_packet);
3077       goto err;
3078     }
3079   }
3080   tot_length= length*(uint) count;
3081   if (!(res= alloc_buffer(res,str,&tmp_value,tot_length)))
3082     goto err;
3083 
3084   to=(char*) res->ptr()+length;
3085   while (--count)
3086   {
3087     memcpy(to,res->ptr(),length);
3088     to+=length;
3089   }
3090   return (res);
3091 
3092 err:
3093   null_value=1;
3094   return 0;
3095 }
3096 
3097 
3098 bool Item_func_space::fix_length_and_dec()
3099 {
3100   collation.set(default_charset(), DERIVATION_COERCIBLE, MY_REPERTOIRE_ASCII);
3101   if (args[0]->const_item() && !args[0]->is_expensive())
3102   {
3103     fix_char_length_ulonglong(Repeat_count(args[0]).count());
3104     return false;
3105   }
3106   max_length= MAX_BLOB_WIDTH;
3107   maybe_null= true;
3108   return false;
3109 }
3110 
3111 
3112 String *Item_func_space::val_str(String *str)
3113 {
3114   uint tot_length;
3115   longlong count= args[0]->val_int();
3116   CHARSET_INFO *cs= collation.collation;
3117 
3118   if (args[0]->null_value)
3119     goto err;				// string and/or delim are null
3120   null_value= 0;
3121 
3122   if (count <= 0 && (count == 0 || !args[0]->unsigned_flag))
3123     return make_empty_result();
3124   /*
3125    Assumes that the maximum length of a String is < INT_MAX32.
3126    Bounds check on count:  If this is triggered, we will error.
3127   */
3128   if ((ulonglong) count > INT_MAX32)
3129     count= INT_MAX32;
3130 
3131   // Safe length check
3132   tot_length= (uint) count * cs->mbminlen;
3133   {
3134     THD *thd= current_thd;
3135     if (tot_length > thd->variables.max_allowed_packet)
3136     {
3137       push_warning_printf(thd, Sql_condition::WARN_LEVEL_WARN,
3138                           ER_WARN_ALLOWED_PACKET_OVERFLOWED,
3139                           ER_THD(thd, ER_WARN_ALLOWED_PACKET_OVERFLOWED),
3140                           func_name(),
3141                           thd->variables.max_allowed_packet);
3142       goto err;
3143     }
3144   }
3145   if (str->alloc(tot_length))
3146     goto err;
3147   str->length(tot_length);
3148   str->set_charset(cs);
3149   cs->cset->fill(cs, (char*) str->ptr(), tot_length, ' ');
3150   return str;
3151 
3152 err:
3153   null_value= 1;
3154   return 0;
3155 }
3156 
3157 
3158 bool Item_func_binlog_gtid_pos::fix_length_and_dec()
3159 {
3160   collation.set(system_charset_info);
3161   max_length= MAX_BLOB_WIDTH;
3162   maybe_null= 1;
3163   return FALSE;
3164 }
3165 
3166 
3167 String *Item_func_binlog_gtid_pos::val_str(String *str)
3168 {
3169   DBUG_ASSERT(fixed == 1);
3170 #ifndef HAVE_REPLICATION
3171   null_value= 0;
3172   str->copy("", 0, system_charset_info);
3173   return str;
3174 #else
3175   String name_str, *name;
3176   longlong pos;
3177 
3178   if (args[0]->null_value || args[1]->null_value)
3179     goto err;
3180 
3181   name= args[0]->val_str(&name_str);
3182   pos= args[1]->val_int();
3183 
3184   if (pos < 0 || pos > UINT_MAX32)
3185     goto err;
3186 
3187   if (gtid_state_from_binlog_pos(name->c_ptr_safe(), (uint32)pos, str))
3188     goto err;
3189   null_value= 0;
3190   return str;
3191 
3192 err:
3193   null_value= 1;
3194   return NULL;
3195 #endif  /* !HAVE_REPLICATION */
3196 }
3197 
3198 
3199 static String *default_pad_str(String *pad_str, CHARSET_INFO *collation)
3200 {
3201   pad_str->set_charset(collation);
3202   pad_str->length(0);
3203   pad_str->append(" ", 1);
3204   return pad_str;
3205 }
3206 
3207 bool Item_func_pad::fix_length_and_dec()
3208 {
3209   if (arg_count == 3)
3210   {
3211     String *str;
3212     if (!args[2]->basic_const_item() || !(str= args[2]->val_str(&pad_str)) || !str->length())
3213       maybe_null= true;
3214     // Handle character set for args[0] and args[2].
3215     if (agg_arg_charsets_for_string_result(collation, &args[0], 2, 2))
3216       return TRUE;
3217   }
3218   else
3219   {
3220     if (agg_arg_charsets_for_string_result(collation, &args[0], 1, 1))
3221       return TRUE;
3222     default_pad_str(&pad_str, collation.collation);
3223   }
3224 
3225   DBUG_ASSERT(collation.collation->mbmaxlen > 0);
3226   if (args[1]->const_item() && !args[1]->is_expensive())
3227   {
3228     fix_char_length_ulonglong(Repeat_count(args[1]).count());
3229     return false;
3230   }
3231   max_length= MAX_BLOB_WIDTH;
3232   maybe_null= true;
3233   return false;
3234 }
3235 
3236 
3237 /*
3238   PAD(expr,length,' ')
3239   removes argument's soft dependency on PAD_CHAR_TO_FULL_LENGTH if the result
3240   is longer than the argument's maximim possible length.
3241 */
3242 Sql_mode_dependency Item_func_rpad::value_depends_on_sql_mode() const
3243 {
3244   DBUG_ASSERT(fixed);
3245   DBUG_ASSERT(arg_count >= 2);
3246   if (!args[1]->value_depends_on_sql_mode_const_item() ||
3247           (arg_count == 3 && !args[2]->value_depends_on_sql_mode_const_item()))
3248     return Item_func::value_depends_on_sql_mode();
3249   Longlong_hybrid len= args[1]->to_longlong_hybrid();
3250   if (args[1]->null_value || len.neg())
3251     return Sql_mode_dependency();                  // will return NULL
3252   if (len.abs() > 0 && len.abs() < args[0]->max_char_length())
3253     return Item_func::value_depends_on_sql_mode();
3254   StringBuffer<64> padstrbuf;
3255   String *padstr= arg_count == 3 ? args[2]->val_str(&padstrbuf) :
3256                                default_pad_str(&padstrbuf, collation.collation);
3257   if (!padstr || !padstr->length())
3258     return Sql_mode_dependency();                  // will return NULL
3259   if (padstr->lengthsp() != 0)
3260     return Item_func::value_depends_on_sql_mode(); // will pad not only spaces
3261   // RPAD(expr, length, ' ')  -- with a long enough length
3262   return ((args[0]->value_depends_on_sql_mode() |
3263            args[1]->value_depends_on_sql_mode()) &
3264           Sql_mode_dependency(~0, ~MODE_PAD_CHAR_TO_FULL_LENGTH)).
3265          soft_to_hard();
3266 }
3267 
3268 
3269 
3270 String *Item_func_rpad::val_str(String *str)
3271 {
3272   DBUG_ASSERT(fixed == 1);
3273   uint32 res_byte_length,res_char_length,pad_char_length,pad_byte_length;
3274   char *to;
3275   const char *ptr_pad;
3276   /* must be longlong to avoid truncation */
3277   longlong count= args[1]->val_int();
3278   longlong byte_count;
3279   String *res= args[0]->val_str(str);
3280   String *rpad= arg_count == 2 ? &pad_str : args[2]->val_str(&pad_str);
3281 
3282   if (!res || args[1]->null_value || !rpad ||
3283       ((count < 0) && !args[1]->unsigned_flag))
3284     goto err;
3285 
3286   null_value=0;
3287 
3288   if (count == 0)
3289     return make_empty_result();
3290 
3291   /* Assumes that the maximum length of a String is < INT_MAX32. */
3292   /* Set here so that rest of code sees out-of-bound value as such. */
3293   if ((ulonglong) count > INT_MAX32)
3294     count= INT_MAX32;
3295   /*
3296     There is one exception not handled (intentionally) by the character set
3297     aggregation code. If one string is strong side and is binary, and
3298     another one is weak side and is a multi-byte character string,
3299     then we need to operate on the second string in terms on bytes when
3300     calling ::numchars() and ::charpos(), rather than in terms of characters.
3301     Lets substitute its character set to binary.
3302   */
3303   if (collation.collation == &my_charset_bin)
3304   {
3305     res->set_charset(&my_charset_bin);
3306     rpad->set_charset(&my_charset_bin);
3307   }
3308 
3309   if (count <= (res_char_length= res->numchars()))
3310   {						// String to pad is big enough
3311     res->length(res->charpos((int) count));	// Shorten result if longer
3312     return (res);
3313   }
3314 
3315   byte_count= count * collation.collation->mbmaxlen;
3316   {
3317     THD *thd= current_thd;
3318     if ((ulonglong) byte_count > thd->variables.max_allowed_packet)
3319     {
3320       push_warning_printf(thd, Sql_condition::WARN_LEVEL_WARN,
3321                           ER_WARN_ALLOWED_PACKET_OVERFLOWED,
3322                           ER_THD(thd, ER_WARN_ALLOWED_PACKET_OVERFLOWED),
3323                           func_name(), thd->variables.max_allowed_packet);
3324       goto err;
3325     }
3326   }
3327 
3328   if (arg_count == 3)
3329   {
3330     if (args[2]->null_value || !(pad_char_length= rpad->numchars()))
3331       goto err;
3332   }
3333   else
3334     pad_char_length= 1; // Implicit space
3335 
3336   res_byte_length= res->length();	/* Must be done before alloc_buffer */
3337   if (!(res= alloc_buffer(res,str,&tmp_value, (ulong) byte_count)))
3338     goto err;
3339 
3340   to= (char*) res->ptr()+res_byte_length;
3341   ptr_pad=rpad->ptr();
3342   pad_byte_length= rpad->length();
3343   count-= res_char_length;
3344   for ( ; (uint32) count > pad_char_length; count-= pad_char_length)
3345   {
3346     memcpy(to,ptr_pad,pad_byte_length);
3347     to+= pad_byte_length;
3348   }
3349   if (count)
3350   {
3351     pad_byte_length= rpad->charpos((int) count);
3352     memcpy(to,ptr_pad,(size_t) pad_byte_length);
3353     to+= pad_byte_length;
3354   }
3355   res->length((uint) (to- (char*) res->ptr()));
3356   return (res);
3357 
3358  err:
3359   null_value=1;
3360   return 0;
3361 }
3362 
3363 
3364 String *Item_func_lpad::val_str(String *str)
3365 {
3366   DBUG_ASSERT(fixed == 1);
3367   uint32 res_char_length,pad_char_length;
3368   /* must be longlong to avoid truncation */
3369   longlong count= args[1]->val_int();
3370   longlong byte_count;
3371   String *res= args[0]->val_str(&tmp_value);
3372   String *pad= arg_count == 2 ? &pad_str : args[2]->val_str(&pad_str);
3373 
3374   if (!res || args[1]->null_value || !pad ||
3375       ((count < 0) && !args[1]->unsigned_flag))
3376     goto err;
3377 
3378   null_value=0;
3379 
3380   if (count == 0)
3381     return make_empty_result();
3382 
3383   /* Assumes that the maximum length of a String is < INT_MAX32. */
3384   /* Set here so that rest of code sees out-of-bound value as such. */
3385   if ((ulonglong) count > INT_MAX32)
3386     count= INT_MAX32;
3387 
3388   /*
3389     There is one exception not handled (intentionally) by the character set
3390     aggregation code. If one string is strong side and is binary, and
3391     another one is weak side and is a multi-byte character string,
3392     then we need to operate on the second string in terms on bytes when
3393     calling ::numchars() and ::charpos(), rather than in terms of characters.
3394     Lets substitute its character set to binary.
3395   */
3396   if (collation.collation == &my_charset_bin)
3397   {
3398     res->set_charset(&my_charset_bin);
3399     pad->set_charset(&my_charset_bin);
3400   }
3401 
3402   res_char_length= res->numchars();
3403 
3404   if (count <= res_char_length)
3405   {
3406     res->length(res->charpos((int) count));
3407     return res;
3408   }
3409 
3410   byte_count= count * collation.collation->mbmaxlen;
3411 
3412   {
3413     THD *thd= current_thd;
3414     if ((ulonglong) byte_count > thd->variables.max_allowed_packet)
3415     {
3416       push_warning_printf(thd, Sql_condition::WARN_LEVEL_WARN,
3417                           ER_WARN_ALLOWED_PACKET_OVERFLOWED,
3418                           ER_THD(thd, ER_WARN_ALLOWED_PACKET_OVERFLOWED),
3419                           func_name(), thd->variables.max_allowed_packet);
3420       goto err;
3421     }
3422   }
3423 
3424   if (str->alloc((uint32) byte_count))
3425     goto err;
3426 
3427   if (arg_count == 3)
3428   {
3429     if (args[2]->null_value || !(pad_char_length= pad->numchars()))
3430       goto err;
3431   }
3432   else
3433     pad_char_length= 1; // Implicit space
3434 
3435   str->length(0);
3436   str->set_charset(collation.collation);
3437   count-= res_char_length;
3438   while (count >= pad_char_length)
3439   {
3440     str->append(*pad);
3441     count-= pad_char_length;
3442   }
3443   if (count > 0)
3444     str->append(pad->ptr(), pad->charpos((int) count), collation.collation);
3445 
3446   str->append(*res);
3447   null_value= 0;
3448   return str;
3449 
3450 err:
3451   null_value= 1;
3452   return 0;
3453 }
3454 
3455 
3456 String *Item_func_conv::val_str(String *str)
3457 {
3458   DBUG_ASSERT(fixed == 1);
3459   String *res= args[0]->val_str(str);
3460   char *endptr,ans[65],*ptr;
3461   longlong dec;
3462   int from_base= (int) args[1]->val_int();
3463   int to_base= (int) args[2]->val_int();
3464   int err;
3465 
3466   // Note that abs(INT_MIN) is undefined.
3467   if (args[0]->null_value || args[1]->null_value || args[2]->null_value ||
3468       from_base == INT_MIN || to_base == INT_MIN ||
3469       abs(to_base) > 36 || abs(to_base) < 2 ||
3470       abs(from_base) > 36 || abs(from_base) < 2 || !(res->length()))
3471   {
3472     null_value= 1;
3473     return NULL;
3474   }
3475   null_value= 0;
3476   unsigned_flag= !(from_base < 0);
3477 
3478   if (args[0]->field_type() == MYSQL_TYPE_BIT)
3479   {
3480     /*
3481      Special case: The string representation of BIT doesn't resemble the
3482      decimal representation, so we shouldn't change it to string and then to
3483      decimal.
3484     */
3485     dec= args[0]->val_int();
3486   }
3487   else
3488   {
3489     if (from_base < 0)
3490       dec= my_strntoll(res->charset(), res->ptr(), res->length(),
3491                        -from_base, &endptr, &err);
3492     else
3493       dec= (longlong) my_strntoull(res->charset(), res->ptr(), res->length(),
3494                                    from_base, &endptr, &err);
3495   }
3496 
3497   if (!(ptr= longlong2str(dec, ans, to_base)) ||
3498       str->copy(ans, (uint32) (ptr - ans), default_charset()))
3499   {
3500     null_value= 1;
3501     return NULL;
3502   }
3503   return str;
3504 }
3505 
3506 
3507 String *Item_func_conv_charset::val_str(String *str)
3508 {
3509   DBUG_ASSERT(fixed == 1);
3510   if (use_cached_value)
3511     return null_value ? 0 : &str_value;
3512   String *arg= args[0]->val_str(&tmp_value);
3513   String_copier_for_item copier(current_thd);
3514   return ((null_value= args[0]->null_value ||
3515                        copier.copy_with_warn(collation.collation, str,
3516                                              arg->charset(), arg->ptr(),
3517                                              arg->length(), arg->length()))) ?
3518     0 : str;
3519 }
3520 
3521 bool Item_func_conv_charset::fix_length_and_dec()
3522 {
3523   DBUG_ASSERT(collation.derivation == DERIVATION_IMPLICIT);
3524   fix_char_length(args[0]->max_char_length());
3525   return FALSE;
3526 }
3527 
3528 void Item_func_conv_charset::print(String *str, enum_query_type query_type)
3529 {
3530   str->append(STRING_WITH_LEN("convert("));
3531   args[0]->print(str, query_type);
3532   str->append(STRING_WITH_LEN(" using "));
3533   str->append(collation.collation->csname);
3534   str->append(')');
3535 }
3536 
3537 String *Item_func_set_collation::val_str(String *str)
3538 {
3539   DBUG_ASSERT(fixed == 1);
3540   str=args[0]->val_str(str);
3541   if ((null_value=args[0]->null_value))
3542     return 0;
3543   str->set_charset(collation.collation);
3544   return str;
3545 }
3546 
3547 bool Item_func_set_collation::fix_length_and_dec()
3548 {
3549   if (!my_charset_same(args[0]->collation.collation, m_set_collation))
3550   {
3551     my_error(ER_COLLATION_CHARSET_MISMATCH, MYF(0),
3552              m_set_collation->name, args[0]->collation.collation->csname);
3553     return TRUE;
3554   }
3555   collation.set(m_set_collation, DERIVATION_EXPLICIT,
3556                 args[0]->collation.repertoire);
3557   max_length= args[0]->max_length;
3558   return FALSE;
3559 }
3560 
3561 
3562 bool Item_func_set_collation::eq(const Item *item, bool binary_cmp) const
3563 {
3564   return Item_func::eq(item, binary_cmp) &&
3565          collation.collation == item->collation.collation;
3566 }
3567 
3568 
3569 void Item_func_set_collation::print(String *str, enum_query_type query_type)
3570 {
3571   args[0]->print_parenthesised(str, query_type, precedence());
3572   str->append(STRING_WITH_LEN(" collate "));
3573   str->append(m_set_collation->name);
3574 }
3575 
3576 String *Item_func_charset::val_str(String *str)
3577 {
3578   DBUG_ASSERT(fixed == 1);
3579   uint dummy_errors;
3580 
3581   CHARSET_INFO *cs= args[0]->charset_for_protocol();
3582   null_value= 0;
3583   str->copy(cs->csname, (uint) strlen(cs->csname),
3584 	    &my_charset_latin1, collation.collation, &dummy_errors);
3585   return str;
3586 }
3587 
3588 String *Item_func_collation::val_str(String *str)
3589 {
3590   DBUG_ASSERT(fixed == 1);
3591   uint dummy_errors;
3592   CHARSET_INFO *cs= args[0]->charset_for_protocol();
3593 
3594   null_value= 0;
3595   str->copy(cs->name, (uint) strlen(cs->name),
3596 	    &my_charset_latin1, collation.collation, &dummy_errors);
3597   return str;
3598 }
3599 
3600 
3601 bool Item_func_weight_string::fix_length_and_dec()
3602 {
3603   CHARSET_INFO *cs= args[0]->collation.collation;
3604   collation.set(&my_charset_bin, args[0]->collation.derivation);
3605   flags= my_strxfrm_flag_normalize(flags, cs->levels_for_order);
3606   /*
3607     Use result_length if it was given explicitly in constructor,
3608     otherwise calculate max_length using argument's max_length
3609     and "nweights".
3610   */
3611   if (!(max_length= result_length))
3612   {
3613     size_t char_length;
3614     char_length= ((cs->state & MY_CS_STRNXFRM_BAD_NWEIGHTS) || !nweights) ?
3615                  args[0]->max_char_length() : nweights * cs->levels_for_order;
3616     max_length= (uint32)cs->coll->strnxfrmlen(cs, char_length * cs->mbmaxlen);
3617   }
3618   maybe_null= 1;
3619   return FALSE;
3620 }
3621 
3622 
3623 /* Return a weight_string according to collation */
3624 String *Item_func_weight_string::val_str(String *str)
3625 {
3626   String *res;
3627   CHARSET_INFO *cs= args[0]->collation.collation;
3628   size_t tmp_length, frm_length;
3629   DBUG_ASSERT(fixed == 1);
3630 
3631   if (args[0]->result_type() != STRING_RESULT ||
3632       !(res= args[0]->val_str(&tmp_value)))
3633     goto nl;
3634 
3635   /*
3636     Use result_length if it was given in constructor
3637     explicitly, otherwise calculate result length
3638     from argument and "nweights".
3639   */
3640   if (!(tmp_length= result_length))
3641   {
3642     size_t char_length;
3643     if (cs->state & MY_CS_STRNXFRM_BAD_NWEIGHTS)
3644     {
3645       /*
3646         latin2_czech_cs and cp1250_czech_cs do not support
3647         the "nweights" limit in strnxfrm(). Use the full length.
3648       */
3649       char_length= res->length();
3650     }
3651     else
3652     {
3653       /*
3654         If we don't need to pad the result with spaces, then it should be
3655         OK to calculate character length of the argument approximately:
3656         "res->length() / cs->mbminlen" can return a number that is
3657         bigger than the real number of characters in the string, so
3658         we'll allocate a little bit more memory but avoid calling
3659         the slow res->numchars().
3660         In case if we do need to pad with spaces, we call res->numchars()
3661         to know the true number of characters.
3662       */
3663       if (!(char_length= nweights))
3664         char_length= (flags & MY_STRXFRM_PAD_WITH_SPACE) ?
3665                       res->numchars() : (res->length() / cs->mbminlen);
3666     }
3667     tmp_length= cs->coll->strnxfrmlen(cs, char_length * cs->mbmaxlen);
3668   }
3669 
3670   {
3671     THD *thd= current_thd;
3672     if (tmp_length > current_thd->variables.max_allowed_packet)
3673     {
3674       push_warning_printf(thd, Sql_condition::WARN_LEVEL_WARN,
3675                           ER_WARN_ALLOWED_PACKET_OVERFLOWED,
3676                           ER_THD(thd, ER_WARN_ALLOWED_PACKET_OVERFLOWED),
3677                           func_name(),
3678                           thd->variables.max_allowed_packet);
3679       goto nl;
3680     }
3681   }
3682 
3683   if (str->alloc(tmp_length))
3684     goto nl;
3685 
3686   frm_length= cs->coll->strnxfrm(cs,
3687                                  (uchar *) str->ptr(), tmp_length,
3688                                  nweights ? nweights : (uint)tmp_length,
3689                                  (const uchar *) res->ptr(), res->length(),
3690                                  flags);
3691   DBUG_ASSERT(frm_length <= tmp_length);
3692 
3693   str->length(frm_length);
3694   null_value= 0;
3695   return str;
3696 
3697 nl:
3698   null_value= 1;
3699   return 0;
3700 }
3701 
3702 
3703 void Item_func_weight_string::print(String *str, enum_query_type query_type)
3704 {
3705   str->append(func_name());
3706   str->append('(');
3707   args[0]->print(str, query_type);
3708   str->append(',');
3709   str->append_ulonglong(result_length);
3710   str->append(',');
3711   str->append_ulonglong(nweights);
3712   str->append(',');
3713   str->append_ulonglong(flags);
3714   str->append(')');
3715 }
3716 
3717 
3718 String *Item_func_hex::val_str_ascii_from_val_real(String *str)
3719 {
3720   ulonglong dec;
3721   double val= args[0]->val_real();
3722   if ((null_value= args[0]->null_value))
3723     return 0;
3724   if ((val <= (double) LONGLONG_MIN) ||
3725       (val >= (double) (ulonglong) ULONGLONG_MAX))
3726     dec= ~(longlong) 0;
3727   else
3728     dec= (ulonglong) (val + (val > 0 ? 0.5 : -0.5));
3729   return str->set_hex(dec) ? make_empty_result() : str;
3730 }
3731 
3732 
3733 String *Item_func_hex::val_str_ascii_from_val_str(String *str)
3734 {
3735   DBUG_ASSERT(&tmp_value != str);
3736   String *res= args[0]->val_str(&tmp_value);
3737   DBUG_ASSERT(res != str);
3738   if ((null_value= (res == NULL)))
3739     return NULL;
3740   return str->set_hex(res->ptr(), res->length()) ? make_empty_result() : str;
3741 }
3742 
3743 
3744 String *Item_func_hex::val_str_ascii_from_val_int(String *str)
3745 {
3746   ulonglong dec= (ulonglong) args[0]->val_int();
3747   if ((null_value= args[0]->null_value))
3748     return 0;
3749   return str->set_hex(dec) ? make_empty_result() : str;
3750 }
3751 
3752 
3753   /** Convert given hex string to a binary string. */
3754 
3755 String *Item_func_unhex::val_str(String *str)
3756 {
3757   const char *from, *end;
3758   char *to;
3759   String *res;
3760   uint length;
3761   DBUG_ASSERT(fixed == 1);
3762 
3763   res= args[0]->val_str(&tmp_value);
3764   if (!res || str->alloc(length= (1+res->length())/2))
3765   {
3766     null_value=1;
3767     return 0;
3768   }
3769 
3770   from= res->ptr();
3771   null_value= 0;
3772   str->length(length);
3773   to= (char*) str->ptr();
3774   if (res->length() % 2)
3775   {
3776     int hex_char;
3777     *to++= hex_char= hexchar_to_int(*from++);
3778     if ((null_value= (hex_char == -1)))
3779       return 0;
3780   }
3781   for (end=res->ptr()+res->length(); from < end ; from+=2, to++)
3782   {
3783     int hex_char;
3784     *to= (hex_char= hexchar_to_int(from[0])) << 4;
3785     if ((null_value= (hex_char == -1)))
3786       return 0;
3787     *to|= hex_char= hexchar_to_int(from[1]);
3788     if ((null_value= (hex_char == -1)))
3789       return 0;
3790   }
3791   return str;
3792 }
3793 
3794 
3795 #ifndef DBUG_OFF
3796 String *Item_func_like_range::val_str(String *str)
3797 {
3798   DBUG_ASSERT(fixed == 1);
3799   longlong nbytes= args[1]->val_int();
3800   String *res= args[0]->val_str(str);
3801   size_t min_len, max_len;
3802   CHARSET_INFO *cs= collation.collation;
3803 
3804   if (!res || args[0]->null_value || args[1]->null_value ||
3805       nbytes < 0 || nbytes > MAX_BLOB_WIDTH ||
3806       min_str.alloc((size_t)nbytes) || max_str.alloc((size_t)nbytes))
3807     goto err;
3808   null_value=0;
3809 
3810   if (cs->coll->like_range(cs, res->ptr(), res->length(),
3811                            '\\', '_', '%', (size_t)nbytes,
3812                            (char*) min_str.ptr(), (char*) max_str.ptr(),
3813                            &min_len, &max_len))
3814     goto err;
3815 
3816   min_str.set_charset(collation.collation);
3817   max_str.set_charset(collation.collation);
3818   min_str.length(min_len);
3819   max_str.length(max_len);
3820 
3821   return is_min ? &min_str : &max_str;
3822 
3823 err:
3824   null_value= 1;
3825   return 0;
3826 }
3827 #endif
3828 
3829 
3830 void Item_func_binary::print(String *str, enum_query_type query_type)
3831 {
3832   str->append(STRING_WITH_LEN("cast("));
3833   args[0]->print(str, query_type);
3834   str->append(STRING_WITH_LEN(" as binary)"));
3835 }
3836 
3837 
3838 #include <my_dir.h>				// For my_stat
3839 
3840 String *Item_load_file::val_str(String *str)
3841 {
3842   DBUG_ASSERT(fixed == 1);
3843   String *file_name;
3844   File file;
3845   MY_STAT stat_info;
3846   char path[FN_REFLEN];
3847   DBUG_ENTER("load_file");
3848 
3849   if (!(file_name= args[0]->val_str(str))
3850 #ifndef NO_EMBEDDED_ACCESS_CHECKS
3851       || !(current_thd->security_ctx->master_access & FILE_ACL)
3852 #endif
3853       )
3854     goto err;
3855 
3856   (void) fn_format(path, file_name->c_ptr_safe(), mysql_real_data_home, "",
3857 		   MY_RELATIVE_PATH | MY_UNPACK_FILENAME);
3858 
3859   /* Read only allowed from within dir specified by secure_file_priv */
3860   if (!is_secure_file_path(path))
3861     goto err;
3862 
3863   if (!mysql_file_stat(key_file_loadfile, path, &stat_info, MYF(0)))
3864     goto err;
3865 
3866   if (!(stat_info.st_mode & S_IROTH))
3867   {
3868     /* my_error(ER_TEXTFILE_NOT_READABLE, MYF(0), file_name->c_ptr()); */
3869     goto err;
3870   }
3871 
3872   {
3873     THD *thd= current_thd;
3874     if (stat_info.st_size > (long) thd->variables.max_allowed_packet)
3875     {
3876       push_warning_printf(thd, Sql_condition::WARN_LEVEL_WARN,
3877                           ER_WARN_ALLOWED_PACKET_OVERFLOWED,
3878                           ER_THD(thd, ER_WARN_ALLOWED_PACKET_OVERFLOWED),
3879                           func_name(), thd->variables.max_allowed_packet);
3880       goto err;
3881     }
3882   }
3883   if (tmp_value.alloc((size_t)stat_info.st_size))
3884     goto err;
3885   if ((file= mysql_file_open(key_file_loadfile,
3886                              file_name->ptr(), O_RDONLY, MYF(0))) < 0)
3887     goto err;
3888   if (mysql_file_read(file, (uchar*) tmp_value.ptr(), (size_t)stat_info.st_size,
3889                       MYF(MY_NABP)))
3890   {
3891     mysql_file_close(file, MYF(0));
3892     goto err;
3893   }
3894   tmp_value.length((uint32)stat_info.st_size);
3895   mysql_file_close(file, MYF(0));
3896   null_value = 0;
3897   DBUG_RETURN(&tmp_value);
3898 
3899 err:
3900   null_value = 1;
3901   DBUG_RETURN(0);
3902 }
3903 
3904 
3905 String* Item_func_export_set::val_str(String* str)
3906 {
3907   DBUG_ASSERT(fixed == 1);
3908   String yes_buf, no_buf, sep_buf;
3909   const ulonglong the_set = (ulonglong) args[0]->val_int();
3910   const String *yes= args[1]->val_str(&yes_buf);
3911   const String *no= args[2]->val_str(&no_buf);
3912   const String *sep= NULL;
3913 
3914   uint num_set_values = 64;
3915   str->length(0);
3916   str->set_charset(collation.collation);
3917 
3918   /* Check if some argument is a NULL value */
3919   if (args[0]->null_value || args[1]->null_value || args[2]->null_value)
3920   {
3921     null_value= true;
3922     return NULL;
3923   }
3924   /*
3925     Arg count can only be 3, 4 or 5 here. This is guaranteed from the
3926     grammar for EXPORT_SET()
3927   */
3928   switch(arg_count) {
3929   case 5:
3930     num_set_values = (uint) args[4]->val_int();
3931     if (num_set_values > 64)
3932       num_set_values=64;
3933     if (args[4]->null_value)
3934     {
3935       null_value= true;
3936       return NULL;
3937     }
3938     /* Fall through */
3939   case 4:
3940     if (!(sep = args[3]->val_str(&sep_buf)))	// Only true if NULL
3941     {
3942       null_value= true;
3943       return NULL;
3944     }
3945     break;
3946   case 3:
3947     {
3948       /* errors is not checked - assume "," can always be converted */
3949       uint errors;
3950       sep_buf.copy(STRING_WITH_LEN(","), &my_charset_bin,
3951                    collation.collation, &errors);
3952       sep = &sep_buf;
3953     }
3954     break;
3955   default:
3956     DBUG_ASSERT(0); // cannot happen
3957   }
3958   null_value= false;
3959 
3960   THD *thd= current_thd;
3961   const ulong max_allowed_packet= thd->variables.max_allowed_packet;
3962   const uint num_separators= num_set_values > 0 ? num_set_values - 1 : 0;
3963   const ulonglong max_total_length=
3964     num_set_values * MY_MAX(yes->length(), no->length()) +
3965     num_separators * sep->length();
3966 
3967   if (unlikely(max_total_length > max_allowed_packet))
3968   {
3969     push_warning_printf(thd, Sql_condition::WARN_LEVEL_WARN,
3970                         ER_WARN_ALLOWED_PACKET_OVERFLOWED,
3971                         ER_THD(thd, ER_WARN_ALLOWED_PACKET_OVERFLOWED),
3972                         func_name(), max_allowed_packet);
3973     null_value= true;
3974     return NULL;
3975   }
3976 
3977   uint ix;
3978   ulonglong mask;
3979   for (ix= 0, mask=0x1; ix < num_set_values; ++ix, mask = (mask << 1))
3980   {
3981     if (the_set & mask)
3982       str->append(*yes);
3983     else
3984       str->append(*no);
3985     if (ix != num_separators)
3986       str->append(*sep);
3987   }
3988   return str;
3989 }
3990 
3991 bool Item_func_export_set::fix_length_and_dec()
3992 {
3993   uint32 length= MY_MAX(args[1]->max_char_length(), args[2]->max_char_length());
3994   uint32 sep_length= (arg_count > 3 ? args[3]->max_char_length() : 1);
3995 
3996   if (agg_arg_charsets_for_string_result(collation,
3997                                          args + 1, MY_MIN(4, arg_count) - 1))
3998     return TRUE;
3999   fix_char_length(length * 64 + sep_length * 63);
4000   return FALSE;
4001 }
4002 
4003 
4004 #define get_esc_bit(mask, num) (1 & (*((mask) + ((num) >> 3))) >> ((num) & 7))
4005 
4006 /**
4007   QUOTE() function returns argument string in single quotes suitable for
4008   using in a SQL statement.
4009 
4010   Adds a \\ before all characters that needs to be escaped in a SQL string.
4011   We also escape '^Z' (END-OF-FILE in windows) to avoid problems when
4012   running commands from a file in windows.
4013 
4014   This function is very useful when you want to generate SQL statements.
4015 
4016   @note
4017     QUOTE(NULL) returns the string 'NULL' (4 letters, without quotes).
4018 
4019   @retval
4020     str	   Quoted string
4021   @retval
4022     NULL	   Out of memory.
4023 */
4024 
4025 String *Item_func_quote::val_str(String *str)
4026 {
4027   DBUG_ASSERT(fixed == 1);
4028   /*
4029     Bit mask that has 1 for set for the position of the following characters:
4030     0, \, ' and ^Z
4031   */
4032 
4033   static uchar escmask[32]=
4034   {
4035     0x01, 0x00, 0x00, 0x04, 0x80, 0x00, 0x00, 0x00,
4036     0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00,
4037     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
4038     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
4039   };
4040 
4041   ulong max_allowed_packet= current_thd->variables.max_allowed_packet;
4042   char *from, *to, *end, *start;
4043   String *arg= args[0]->val_str(&tmp_value);
4044   uint arg_length, new_length;
4045   if (!arg)					// Null argument
4046   {
4047     /* Return the string 'NULL' */
4048     str->copy(STRING_WITH_LEN("NULL"), collation.collation);
4049     null_value= 0;
4050     return str;
4051   }
4052 
4053   arg_length= arg->length();
4054 
4055   if (collation.collation->mbmaxlen == 1)
4056   {
4057     new_length= arg_length + 2; /* for beginning and ending ' signs */
4058     for (from= (char*) arg->ptr(), end= from + arg_length; from < end; from++)
4059       new_length+= get_esc_bit(escmask, (uchar) *from);
4060     if (new_length > max_allowed_packet)
4061       goto toolong;
4062   }
4063   else
4064   {
4065     new_length= (arg_length * 2) +  /* For string characters */
4066                 (2 * collation.collation->mbmaxlen); /* For quotes */
4067     set_if_smaller(new_length, max_allowed_packet);
4068   }
4069 
4070   if (str->alloc(new_length))
4071     goto null;
4072 
4073   if (collation.collation->mbmaxlen > 1)
4074   {
4075     CHARSET_INFO *cs= collation.collation;
4076     int mblen;
4077     uchar *to_end;
4078     to= (char*) str->ptr();
4079     to_end= (uchar*) to + new_length;
4080 
4081     /* Put leading quote */
4082     if ((mblen= cs->cset->wc_mb(cs, '\'', (uchar *) to, to_end)) <= 0)
4083       goto toolong;
4084     to+= mblen;
4085 
4086     for (start= (char*) arg->ptr(), end= start + arg_length; start < end; )
4087     {
4088       my_wc_t wc;
4089       bool escape;
4090       if ((mblen= cs->cset->mb_wc(cs, &wc, (uchar*) start, (uchar*) end)) <= 0)
4091         goto null;
4092       start+= mblen;
4093       switch (wc) {
4094         case 0:      escape= 1; wc= '0'; break;
4095         case '\032': escape= 1; wc= 'Z'; break;
4096         case '\'':   escape= 1; break;
4097         case '\\':   escape= 1; break;
4098         default:     escape= 0; break;
4099       }
4100       if (escape)
4101       {
4102         if ((mblen= cs->cset->wc_mb(cs, '\\', (uchar*) to, to_end)) <= 0)
4103           goto toolong;
4104         to+= mblen;
4105       }
4106       if ((mblen= cs->cset->wc_mb(cs, wc, (uchar*) to, to_end)) <= 0)
4107         goto toolong;
4108       to+= mblen;
4109     }
4110 
4111     /* Put trailing quote */
4112     if ((mblen= cs->cset->wc_mb(cs, '\'', (uchar *) to, to_end)) <= 0)
4113       goto toolong;
4114     to+= mblen;
4115     new_length= (uint)(to - str->ptr());
4116     goto ret;
4117   }
4118 
4119   /*
4120     We replace characters from the end to the beginning
4121   */
4122   to= (char*) str->ptr() + new_length - 1;
4123   *to--= '\'';
4124   for (start= (char*) arg->ptr(),end= start + arg_length; end-- != start; to--)
4125   {
4126     /*
4127       We can't use the bitmask here as we want to replace \O and ^Z with 0
4128       and Z
4129     */
4130     switch (*end)  {
4131     case 0:
4132       *to--= '0';
4133       *to=   '\\';
4134       break;
4135     case '\032':
4136       *to--= 'Z';
4137       *to=   '\\';
4138       break;
4139     case '\'':
4140     case '\\':
4141       *to--= *end;
4142       *to=   '\\';
4143       break;
4144     default:
4145       *to= *end;
4146       break;
4147     }
4148   }
4149   *to= '\'';
4150 
4151 ret:
4152   str->length(new_length);
4153   str->set_charset(collation.collation);
4154   null_value= 0;
4155   return str;
4156 
4157 toolong:
4158   push_warning_printf(current_thd, Sql_condition::WARN_LEVEL_WARN,
4159                       ER_WARN_ALLOWED_PACKET_OVERFLOWED,
4160                       ER_THD(current_thd, ER_WARN_ALLOWED_PACKET_OVERFLOWED),
4161                       func_name(), max_allowed_packet);
4162 null:
4163   null_value= 1;
4164   return 0;
4165 }
4166 
4167 longlong Item_func_uncompressed_length::val_int()
4168 {
4169   DBUG_ASSERT(fixed == 1);
4170   String *res= args[0]->val_str(&value);
4171   if (!res)
4172   {
4173     null_value=1;
4174     return 0; /* purecov: inspected */
4175   }
4176   null_value=0;
4177   if (res->is_empty()) return 0;
4178 
4179   /*
4180     If length is <= 4 bytes, data is corrupt. This is the best we can do
4181     to detect garbage input without decompressing it.
4182   */
4183   if (res->length() <= 4)
4184   {
4185     THD *thd= current_thd;
4186     push_warning_printf(thd, Sql_condition::WARN_LEVEL_WARN,
4187                         ER_ZLIB_Z_DATA_ERROR,
4188                         ER_THD(thd, ER_ZLIB_Z_DATA_ERROR));
4189     null_value= 1;
4190     return 0;
4191   }
4192 
4193  /*
4194     res->ptr() using is safe because we have tested that string is at least
4195     5 bytes long.
4196     res->c_ptr() is not used because:
4197       - we do not need \0 terminated string to get first 4 bytes
4198       - c_ptr() tests simbol after string end (uninitialized memory) which
4199         confuse valgrind
4200   */
4201   return uint4korr(res->ptr()) & 0x3FFFFFFF;
4202 }
4203 
4204 longlong Item_func_crc32::val_int()
4205 {
4206   DBUG_ASSERT(fixed == 1);
4207   String *res=args[0]->val_str(&value);
4208   if (!res)
4209   {
4210     null_value=1;
4211     return 0; /* purecov: inspected */
4212   }
4213   null_value=0;
4214   return (longlong) my_checksum(0L, (uchar*)res->ptr(), res->length());
4215 }
4216 
4217 #ifdef HAVE_COMPRESS
4218 #include "zlib.h"
4219 
4220 String *Item_func_compress::val_str(String *str)
4221 {
4222   int err= Z_OK, code;
4223   size_t new_size;
4224   String *res;
4225   Byte *body;
4226   char *tmp, *last_char;
4227   DBUG_ASSERT(fixed == 1);
4228 
4229   if (!(res= args[0]->val_str(&tmp_value)))
4230   {
4231     null_value= 1;
4232     return 0;
4233   }
4234   null_value= 0;
4235   if (res->is_empty()) return res;
4236 
4237   /*
4238     Citation from zlib.h (comment for compress function):
4239 
4240     Compresses the source buffer into the destination buffer.  sourceLen is
4241     the byte length of the source buffer. Upon entry, destLen is the total
4242     size of the destination buffer, which must be at least 0.1% larger than
4243     sourceLen plus 12 bytes.
4244     We assume here that the buffer can't grow more than .25 %.
4245   */
4246   new_size= res->length() + res->length() / 5 + 12;
4247 
4248   // Check new_size overflow: new_size <= res->length()
4249   if (((uint32) (new_size+5) <= res->length()) ||
4250       str->realloc((uint32) new_size + 4 + 1))
4251   {
4252     null_value= 1;
4253     return 0;
4254   }
4255 
4256   body= ((Byte*)str->ptr()) + 4;
4257 
4258   // As far as we have checked res->is_empty() we can use ptr()
4259   if ((err= my_compress_buffer(body, &new_size, (const uchar *)res->ptr(),
4260                                res->length())) != Z_OK)
4261   {
4262     THD *thd= current_thd;
4263     code= err==Z_MEM_ERROR ? ER_ZLIB_Z_MEM_ERROR : ER_ZLIB_Z_BUF_ERROR;
4264     push_warning(thd, Sql_condition::WARN_LEVEL_WARN, code,
4265                  ER_THD(thd, code));
4266     null_value= 1;
4267     return 0;
4268   }
4269 
4270   tmp= (char*) str->ptr(); // int4store is a macro; avoid side effects
4271   int4store(tmp, res->length() & 0x3FFFFFFF);
4272 
4273   /* This is to ensure that things works for CHAR fields, which trim ' ': */
4274   last_char= ((char*)body)+new_size-1;
4275   if (*last_char == ' ')
4276   {
4277     *++last_char= '.';
4278     new_size++;
4279   }
4280 
4281   str->length((uint32)new_size + 4);
4282   return str;
4283 }
4284 
4285 
4286 String *Item_func_uncompress::val_str(String *str)
4287 {
4288   DBUG_ASSERT(fixed == 1);
4289   String *res= args[0]->val_str(&tmp_value);
4290   ulong new_size;
4291   int err;
4292   uint code;
4293 
4294   if (!res)
4295     goto err;
4296   null_value= 0;
4297   if (res->is_empty())
4298     return res;
4299 
4300   /* If length is less than 4 bytes, data is corrupt */
4301   if (res->length() <= 4)
4302   {
4303     THD *thd= current_thd;
4304     push_warning_printf(thd, Sql_condition::WARN_LEVEL_WARN,
4305 			ER_ZLIB_Z_DATA_ERROR,
4306 			ER_THD(thd, ER_ZLIB_Z_DATA_ERROR));
4307     goto err;
4308   }
4309 
4310   /* Size of uncompressed data is stored as first 4 bytes of field */
4311   new_size= uint4korr(res->ptr()) & 0x3FFFFFFF;
4312   if (new_size > current_thd->variables.max_allowed_packet)
4313   {
4314     THD *thd= current_thd;
4315     push_warning_printf(thd,Sql_condition::WARN_LEVEL_WARN,
4316 			ER_TOO_BIG_FOR_UNCOMPRESS,
4317 			ER_THD(thd, ER_TOO_BIG_FOR_UNCOMPRESS),
4318                         static_cast<int>(thd->variables.
4319                                          max_allowed_packet));
4320     goto err;
4321   }
4322   if (str->realloc((uint32)new_size))
4323     goto err;
4324 
4325   if ((err= uncompress((Byte*)str->ptr(), &new_size,
4326 		       ((const Bytef*)res->ptr())+4,res->length()-4)) == Z_OK)
4327   {
4328     str->length((uint32) new_size);
4329     return str;
4330   }
4331 
4332   code= ((err == Z_BUF_ERROR) ? ER_ZLIB_Z_BUF_ERROR :
4333 	 ((err == Z_MEM_ERROR) ? ER_ZLIB_Z_MEM_ERROR : ER_ZLIB_Z_DATA_ERROR));
4334   {
4335     THD *thd= current_thd;
4336     push_warning(thd, Sql_condition::WARN_LEVEL_WARN, code, ER_THD(thd, code));
4337   }
4338 
4339 err:
4340   null_value= 1;
4341   return 0;
4342 }
4343 #endif
4344 
4345 
4346 String *Item_func_uuid::val_str(String *str)
4347 {
4348   DBUG_ASSERT(fixed == 1);
4349   uchar guid[MY_UUID_SIZE];
4350 
4351   str->realloc(MY_UUID_STRING_LENGTH+1);
4352   str->length(MY_UUID_STRING_LENGTH);
4353   str->set_charset(system_charset_info);
4354   my_uuid(guid);
4355   my_uuid2str(guid, (char *)str->ptr());
4356 
4357   return str;
4358 }
4359 
4360 
4361 Item_func_dyncol_create::Item_func_dyncol_create(THD *thd, List<Item> &args,
4362                                                  DYNCALL_CREATE_DEF *dfs):
4363   Item_str_func(thd, args), defs(dfs), vals(0), keys_num(NULL), keys_str(NULL),
4364   names(FALSE), force_names(FALSE)
4365 {
4366   DBUG_ASSERT((args.elements & 0x1) == 0); // even number of arguments
4367 }
4368 
4369 
4370 bool Item_func_dyncol_create::fix_fields(THD *thd, Item **ref)
4371 {
4372   uint i;
4373   bool res= Item_func::fix_fields(thd, ref); // no need Item_str_func here
4374   if (!res)
4375   {
4376     vals= (DYNAMIC_COLUMN_VALUE *) alloc_root(thd->mem_root,
4377                                               sizeof(DYNAMIC_COLUMN_VALUE) *
4378                                               (arg_count / 2));
4379     for (i= 0;
4380          i + 1 < arg_count && args[i]->result_type() == INT_RESULT;
4381          i+= 2)
4382       ;
4383     if (i + 1 < arg_count)
4384     {
4385       names= TRUE;
4386     }
4387 
4388     keys_num= (uint *) alloc_root(thd->mem_root,
4389                                (sizeof(LEX_STRING) > sizeof(uint) ?
4390                                 sizeof(LEX_STRING) :
4391                                 sizeof(uint)) *
4392                                (arg_count / 2));
4393     keys_str= (LEX_STRING *) keys_num;
4394     status_var_increment(thd->status_var.feature_dynamic_columns);
4395   }
4396   return res || vals == 0 || keys_num == 0;
4397 }
4398 
4399 
4400 bool Item_func_dyncol_create::fix_length_and_dec()
4401 {
4402   max_length= MAX_BLOB_WIDTH;
4403   maybe_null= TRUE;
4404   collation.set(&my_charset_bin);
4405   decimals= 0;
4406   return FALSE;
4407 }
4408 
4409 bool Item_func_dyncol_create::prepare_arguments(THD *thd, bool force_names_arg)
4410 {
4411   char buff[STRING_BUFFER_USUAL_SIZE];
4412   String *res, tmp(buff, sizeof(buff), &my_charset_bin);
4413   uint column_count= (arg_count / 2);
4414   uint i;
4415   my_decimal dtmp, *dres;
4416   force_names= force_names_arg;
4417 
4418   if (!(names || force_names))
4419   {
4420     for (i= 0; i < column_count; i++)
4421     {
4422       uint valpos= i * 2 + 1;
4423       DYNAMIC_COLUMN_TYPE type= defs[i].type;
4424       if (type == DYN_COL_NULL)
4425         switch (args[valpos]->field_type())
4426         {
4427         case MYSQL_TYPE_VARCHAR:
4428         case MYSQL_TYPE_ENUM:
4429         case MYSQL_TYPE_SET:
4430         case MYSQL_TYPE_TINY_BLOB:
4431         case MYSQL_TYPE_MEDIUM_BLOB:
4432         case MYSQL_TYPE_LONG_BLOB:
4433         case MYSQL_TYPE_BLOB:
4434         case MYSQL_TYPE_VAR_STRING:
4435         case MYSQL_TYPE_STRING:
4436         case MYSQL_TYPE_GEOMETRY:
4437           type= DYN_COL_STRING;
4438           break;
4439         default:
4440           break;
4441         }
4442 
4443       if (type == DYN_COL_STRING &&
4444           args[valpos]->type() == Item::FUNC_ITEM &&
4445           ((Item_func *)args[valpos])->functype() == DYNCOL_FUNC)
4446       {
4447         force_names= 1;
4448         break;
4449       }
4450     }
4451   }
4452 
4453   /* get values */
4454   for (i= 0; i < column_count; i++)
4455   {
4456     uint valpos= i * 2 + 1;
4457     DYNAMIC_COLUMN_TYPE type= defs[i].type;
4458     if (type == DYN_COL_NULL) // auto detect
4459     {
4460       /*
4461         We don't have a default here to ensure we get a warning if
4462         one adds a new not handled MYSQL_TYPE_...
4463       */
4464       switch (args[valpos]->field_type()) {
4465       case MYSQL_TYPE_DECIMAL:
4466       case MYSQL_TYPE_NEWDECIMAL:
4467         type= DYN_COL_DECIMAL;
4468         break;
4469       case MYSQL_TYPE_TINY:
4470       case MYSQL_TYPE_SHORT:
4471       case MYSQL_TYPE_LONG:
4472       case MYSQL_TYPE_LONGLONG:
4473       case MYSQL_TYPE_INT24:
4474       case MYSQL_TYPE_YEAR:
4475       case MYSQL_TYPE_BIT:
4476         type= args[valpos]->unsigned_flag ? DYN_COL_UINT : DYN_COL_INT;
4477         break;
4478       case MYSQL_TYPE_FLOAT:
4479       case MYSQL_TYPE_DOUBLE:
4480         type= DYN_COL_DOUBLE;
4481         break;
4482       case MYSQL_TYPE_NULL:
4483         type= DYN_COL_NULL;
4484         break;
4485       case MYSQL_TYPE_TIMESTAMP:
4486       case MYSQL_TYPE_TIMESTAMP2:
4487       case MYSQL_TYPE_DATETIME:
4488       case MYSQL_TYPE_DATETIME2:
4489         type= DYN_COL_DATETIME;
4490 	break;
4491       case MYSQL_TYPE_DATE:
4492       case MYSQL_TYPE_NEWDATE:
4493         type= DYN_COL_DATE;
4494         break;
4495       case MYSQL_TYPE_TIME:
4496       case MYSQL_TYPE_TIME2:
4497         type= DYN_COL_TIME;
4498         break;
4499       case MYSQL_TYPE_VARCHAR:
4500       case MYSQL_TYPE_ENUM:
4501       case MYSQL_TYPE_SET:
4502       case MYSQL_TYPE_TINY_BLOB:
4503       case MYSQL_TYPE_MEDIUM_BLOB:
4504       case MYSQL_TYPE_LONG_BLOB:
4505       case MYSQL_TYPE_BLOB:
4506       case MYSQL_TYPE_VAR_STRING:
4507       case MYSQL_TYPE_STRING:
4508       case MYSQL_TYPE_GEOMETRY:
4509         type= DYN_COL_STRING;
4510         break;
4511       case MYSQL_TYPE_VARCHAR_COMPRESSED:
4512       case MYSQL_TYPE_BLOB_COMPRESSED:
4513         DBUG_ASSERT(0);
4514       }
4515     }
4516     if (type == DYN_COL_STRING &&
4517         args[valpos]->type() == Item::FUNC_ITEM &&
4518         ((Item_func *)args[valpos])->functype() == DYNCOL_FUNC)
4519     {
4520       DBUG_ASSERT(names || force_names);
4521       type= DYN_COL_DYNCOL;
4522     }
4523     if (names || force_names)
4524     {
4525       res= args[i * 2]->val_str(&tmp);
4526       if (res)
4527       {
4528         // guaranty UTF-8 string for names
4529         if (my_charset_same(res->charset(), DYNCOL_UTF))
4530         {
4531           keys_str[i].length= res->length();
4532           keys_str[i].str= thd->strmake(res->ptr(), res->length());
4533         }
4534         else
4535         {
4536           uint strlen= res->length() * DYNCOL_UTF->mbmaxlen + 1;
4537           uint dummy_errors;
4538           if (char *str= (char *) thd->alloc(strlen))
4539           {
4540             keys_str[i].length=
4541               copy_and_convert(str, strlen, DYNCOL_UTF,
4542                                res->ptr(), res->length(), res->charset(),
4543                                &dummy_errors);
4544               keys_str[i].str= str;
4545           }
4546           else
4547             keys_str[i].length= 0;
4548 
4549         }
4550       }
4551       else
4552       {
4553         keys_str[i].length= 0;
4554         keys_str[i].str= NULL;
4555       }
4556     }
4557     else
4558       keys_num[i]= (uint) args[i * 2]->val_int();
4559     if (args[i * 2]->null_value)
4560     {
4561       /* to make cleanup possible */
4562       for (; i < column_count; i++)
4563         vals[i].type= DYN_COL_NULL;
4564       return 1;
4565     }
4566     vals[i].type= type;
4567     switch (type) {
4568     case DYN_COL_NULL:
4569       DBUG_ASSERT(args[valpos]->field_type() == MYSQL_TYPE_NULL);
4570       break;
4571     case DYN_COL_INT:
4572       vals[i].x.long_value= args[valpos]->val_int();
4573       break;
4574     case DYN_COL_UINT:
4575       vals[i].x.ulong_value= args[valpos]->val_int();
4576       break;
4577     case DYN_COL_DOUBLE:
4578       vals[i].x.double_value= args[valpos]->val_real();
4579       break;
4580     case DYN_COL_DYNCOL:
4581     case DYN_COL_STRING:
4582       res= args[valpos]->val_str(&tmp);
4583       if (res && defs[i].cs)
4584         res->set_charset(defs[i].cs);
4585       if (res &&
4586           (vals[i].x.string.value.str= thd->strmake(res->ptr(), res->length())))
4587       {
4588 	vals[i].x.string.value.length= res->length();
4589 	vals[i].x.string.charset= res->charset();
4590       }
4591       else
4592       {
4593         args[valpos]->null_value= 1;            // In case of out of memory
4594         vals[i].x.string.value.str= NULL;
4595         vals[i].x.string.value.length= 0;         // just to be safe
4596       }
4597       break;
4598     case DYN_COL_DECIMAL:
4599       if ((dres= args[valpos]->val_decimal(&dtmp)))
4600       {
4601 	mariadb_dyncol_prepare_decimal(&vals[i]);
4602         DBUG_ASSERT(vals[i].x.decimal.value.len == dres->len);
4603         vals[i].x.decimal.value.intg= dres->intg;
4604         vals[i].x.decimal.value.frac= dres->frac;
4605         vals[i].x.decimal.value.sign= dres->sign();
4606         memcpy(vals[i].x.decimal.buffer, dres->buf,
4607                sizeof(vals[i].x.decimal.buffer));
4608       }
4609       else
4610       {
4611 	mariadb_dyncol_prepare_decimal(&vals[i]); // just to be safe
4612         DBUG_ASSERT(args[valpos]->null_value);
4613       }
4614       break;
4615     case DYN_COL_DATETIME:
4616     case DYN_COL_DATE:
4617       args[valpos]->get_date(&vals[i].x.time_value,
4618                              sql_mode_for_dates(thd));
4619       break;
4620     case DYN_COL_TIME:
4621       args[valpos]->get_time(&vals[i].x.time_value);
4622       break;
4623     default:
4624       DBUG_ASSERT(0);
4625       vals[i].type= DYN_COL_NULL;
4626     }
4627     if (vals[i].type != DYN_COL_NULL && args[valpos]->null_value)
4628     {
4629       vals[i].type= DYN_COL_NULL;
4630     }
4631   }
4632   return FALSE;
4633 }
4634 
4635 
4636 String *Item_func_dyncol_create::val_str(String *str)
4637 {
4638   DYNAMIC_COLUMN col;
4639   String *res;
4640   uint column_count= (arg_count / 2);
4641   enum enum_dyncol_func_result rc;
4642   DBUG_ASSERT((arg_count & 0x1) == 0); // even number of arguments
4643 
4644   /* FIXME: add thd argument to Item::val_str() */
4645   if (prepare_arguments(current_thd, FALSE))
4646   {
4647     res= NULL;
4648     null_value= 1;
4649   }
4650   else
4651   {
4652     if ((rc= ((names || force_names) ?
4653               mariadb_dyncol_create_many_named(&col, column_count, keys_str,
4654                                                vals, TRUE) :
4655               mariadb_dyncol_create_many_num(&col, column_count, keys_num,
4656                                              vals, TRUE))))
4657     {
4658       dynamic_column_error_message(rc);
4659       mariadb_dyncol_free(&col);
4660       res= NULL;
4661       null_value= TRUE;
4662     }
4663     else
4664     {
4665       /* Move result from DYNAMIC_COLUMN to str_value */
4666       char *ptr;
4667       size_t length, alloc_length;
4668       dynstr_reassociate(&col, &ptr, &length, &alloc_length);
4669       str_value.reset(ptr, length, alloc_length, &my_charset_bin);
4670       res= &str_value;
4671       null_value= FALSE;
4672     }
4673   }
4674 
4675   return res;
4676 }
4677 
4678 void Item_func_dyncol_create::print_arguments(String *str,
4679                                               enum_query_type query_type)
4680 {
4681   uint i;
4682   uint column_count= (arg_count / 2);
4683   for (i= 0; i < column_count; i++)
4684   {
4685     args[i*2]->print(str, query_type);
4686     str->append(',');
4687     args[i*2 + 1]->print(str, query_type);
4688     switch (defs[i].type) {
4689     case DYN_COL_NULL: // automatic type => write nothing
4690       break;
4691     case DYN_COL_INT:
4692       str->append(STRING_WITH_LEN(" AS int"));
4693       break;
4694     case DYN_COL_UINT:
4695       str->append(STRING_WITH_LEN(" AS unsigned int"));
4696       break;
4697     case DYN_COL_DOUBLE:
4698       str->append(STRING_WITH_LEN(" AS double"));
4699       break;
4700     case DYN_COL_DYNCOL:
4701     case DYN_COL_STRING:
4702       str->append(STRING_WITH_LEN(" AS char"));
4703       if (defs[i].cs)
4704       {
4705         str->append(STRING_WITH_LEN(" charset "));
4706         str->append(defs[i].cs->csname);
4707         str->append(' ');
4708       }
4709       break;
4710     case DYN_COL_DECIMAL:
4711       str->append(STRING_WITH_LEN(" AS decimal"));
4712       break;
4713     case DYN_COL_DATETIME:
4714       str->append(STRING_WITH_LEN(" AS datetime"));
4715       break;
4716     case DYN_COL_DATE:
4717       str->append(STRING_WITH_LEN(" AS date"));
4718       break;
4719     case DYN_COL_TIME:
4720       str->append(STRING_WITH_LEN(" AS time"));
4721       break;
4722     }
4723     if (i < column_count - 1)
4724       str->append(',');
4725   }
4726 }
4727 
4728 
4729 void Item_func_dyncol_create::print(String *str,
4730                                     enum_query_type query_type)
4731 {
4732   DBUG_ASSERT((arg_count & 0x1) == 0); // even number of arguments
4733   str->append(STRING_WITH_LEN("column_create("));
4734   print_arguments(str, query_type);
4735   str->append(')');
4736 }
4737 
4738 String *Item_func_dyncol_json::val_str(String *str)
4739 {
4740   DYNAMIC_STRING json, col;
4741   String *res;
4742   enum enum_dyncol_func_result rc;
4743 
4744   res= args[0]->val_str(str);
4745   if (args[0]->null_value)
4746     goto null;
4747 
4748   col.str= (char *)res->ptr();
4749   col.length= res->length();
4750   if ((rc= mariadb_dyncol_json(&col, &json)))
4751   {
4752     dynamic_column_error_message(rc);
4753     goto null;
4754   }
4755   bzero(&col, sizeof(col));
4756   {
4757     /* Move result from DYNAMIC_COLUMN to str */
4758     char *ptr;
4759     size_t length, alloc_length;
4760     dynstr_reassociate(&json, &ptr, &length, &alloc_length);
4761     str->reset(ptr, length, alloc_length, DYNCOL_UTF);
4762     null_value= FALSE;
4763   }
4764   str->set_charset(DYNCOL_UTF);
4765   return str;
4766 
4767 null:
4768   bzero(&col, sizeof(col));
4769   null_value= TRUE;
4770   return NULL;
4771 }
4772 
4773 String *Item_func_dyncol_add::val_str(String *str)
4774 {
4775   DYNAMIC_COLUMN col;
4776   String *res;
4777   uint column_count=  (arg_count / 2);
4778   enum enum_dyncol_func_result rc;
4779   DBUG_ASSERT((arg_count & 0x1) == 1); // odd number of arguments
4780 
4781   /* We store the packed data last */
4782   res= args[arg_count - 1]->val_str(str);
4783   if (args[arg_count - 1]->null_value ||
4784       init_dynamic_string(&col, NULL, res->length() + STRING_BUFFER_USUAL_SIZE,
4785                           STRING_BUFFER_USUAL_SIZE))
4786     goto null;
4787 
4788   col.length= res->length();
4789   memcpy(col.str, res->ptr(), col.length);
4790 
4791   /* FIXME: add thd argument to Item::val_str() */
4792   if (prepare_arguments(current_thd, mariadb_dyncol_has_names(&col)))
4793     goto null;
4794 
4795   if ((rc= ((names || force_names) ?
4796             mariadb_dyncol_update_many_named(&col, column_count,
4797                                              keys_str, vals) :
4798             mariadb_dyncol_update_many_num(&col, column_count,
4799                                            keys_num, vals))))
4800   {
4801     dynamic_column_error_message(rc);
4802     mariadb_dyncol_free(&col);
4803     goto null;
4804   }
4805 
4806   {
4807     /* Move result from DYNAMIC_COLUMN to str */
4808     char *ptr;
4809     size_t length, alloc_length;
4810     dynstr_reassociate(&col, &ptr, &length, &alloc_length);
4811     str->reset(ptr, length, alloc_length, &my_charset_bin);
4812     null_value= FALSE;
4813   }
4814 
4815   return str;
4816 
4817 null:
4818   null_value= TRUE;
4819   return NULL;
4820 }
4821 
4822 
4823 void Item_func_dyncol_add::print(String *str,
4824                                  enum_query_type query_type)
4825 {
4826   DBUG_ASSERT((arg_count & 0x1) == 1); // odd number of arguments
4827   str->append(STRING_WITH_LEN("column_add("));
4828   args[arg_count - 1]->print(str, query_type);
4829   str->append(',');
4830   print_arguments(str, query_type);
4831   str->append(')');
4832 }
4833 
4834 
4835 /**
4836   Get value for a column stored in a dynamic column
4837 
4838   @notes
4839   This function ensures that null_value is set correctly
4840 */
4841 
4842 bool Item_dyncol_get::get_dyn_value(THD *thd, DYNAMIC_COLUMN_VALUE *val,
4843                                     String *tmp)
4844 {
4845   DYNAMIC_COLUMN dyn_str;
4846   String *res;
4847   longlong num= 0;
4848   LEX_STRING buf, *name= NULL;
4849   char nmstrbuf[11];
4850   String nmbuf(nmstrbuf, sizeof(nmstrbuf), system_charset_info);
4851   enum enum_dyncol_func_result rc;
4852 
4853   if (args[1]->result_type() == INT_RESULT)
4854     num= args[1]->val_int();
4855   else
4856   {
4857     String *nm= args[1]->val_str(&nmbuf);
4858     if (!nm || args[1]->null_value)
4859     {
4860       null_value= 1;
4861       return 1;
4862     }
4863 
4864     if (my_charset_same(nm->charset(), DYNCOL_UTF))
4865     {
4866       buf.str= (char *) nm->ptr();
4867       buf.length= nm->length();
4868     }
4869     else
4870     {
4871       uint strlen= nm->length() * DYNCOL_UTF->mbmaxlen + 1;
4872       uint dummy_errors;
4873       buf.str= (char *) thd->alloc(strlen);
4874       if (buf.str)
4875       {
4876         buf.length=
4877           copy_and_convert(buf.str, strlen, DYNCOL_UTF,
4878                            nm->ptr(), nm->length(), nm->charset(),
4879                            &dummy_errors);
4880       }
4881       else
4882         buf.length= 0;
4883     }
4884     name= &buf;
4885   }
4886 
4887 
4888   if (args[1]->null_value || num < 0 || num > INT_MAX)
4889   {
4890     null_value= 1;
4891     return 1;
4892   }
4893 
4894   res= args[0]->val_str(tmp);
4895   if (args[0]->null_value)
4896   {
4897     null_value= 1;
4898     return 1;
4899   }
4900 
4901   dyn_str.str=   (char*) res->ptr();
4902   dyn_str.length= res->length();
4903   if ((rc= ((name == NULL) ?
4904             mariadb_dyncol_get_num(&dyn_str, (uint) num, val) :
4905             mariadb_dyncol_get_named(&dyn_str, name, val))))
4906   {
4907     dynamic_column_error_message(rc);
4908     null_value= 1;
4909     return 1;
4910   }
4911 
4912   null_value= 0;
4913   return 0;                                     // ok
4914 }
4915 
4916 
4917 String *Item_dyncol_get::val_str(String *str_result)
4918 {
4919   DYNAMIC_COLUMN_VALUE val;
4920   char buff[STRING_BUFFER_USUAL_SIZE];
4921   String tmp(buff, sizeof(buff), &my_charset_bin);
4922 
4923   if (get_dyn_value(current_thd, &val, &tmp))
4924     return NULL;
4925 
4926   switch (val.type) {
4927   case DYN_COL_NULL:
4928     goto null;
4929   case DYN_COL_INT:
4930   case DYN_COL_UINT:
4931     str_result->set_int(val.x.long_value, MY_TEST(val.type == DYN_COL_UINT),
4932                        &my_charset_latin1);
4933     break;
4934   case DYN_COL_DOUBLE:
4935     str_result->set_real(val.x.double_value, NOT_FIXED_DEC, &my_charset_latin1);
4936     break;
4937   case DYN_COL_DYNCOL:
4938   case DYN_COL_STRING:
4939     if ((char*) tmp.ptr() <= val.x.string.value.str &&
4940         (char*) tmp.ptr() + tmp.length() >= val.x.string.value.str)
4941     {
4942       /* value is allocated in tmp buffer; We have to make a copy */
4943       str_result->copy(val.x.string.value.str, val.x.string.value.length,
4944                       val.x.string.charset);
4945     }
4946     else
4947     {
4948       /*
4949         It's safe to use the current value because it's either pointing
4950         into a field or in a buffer for another item and this buffer
4951         is not going to be deleted during expression evaluation
4952       */
4953       str_result->set(val.x.string.value.str, val.x.string.value.length,
4954                       val.x.string.charset);
4955     }
4956     break;
4957   case DYN_COL_DECIMAL:
4958   {
4959     int res;
4960     int length= decimal_string_size(&val.x.decimal.value);
4961     if (str_result->alloc(length))
4962       goto null;
4963     if ((res= decimal2string(&val.x.decimal.value, (char*) str_result->ptr(),
4964                              &length, 0, 0, ' ')) != E_DEC_OK)
4965     {
4966       char buff[40];
4967       int len= sizeof(buff);
4968       DBUG_ASSERT(length < (int)sizeof(buff));
4969       decimal2string(&val.x.decimal.value, buff, &len, 0, 0, ' ');
4970       decimal_operation_results(res, buff, "CHAR");
4971     }
4972     str_result->set_charset(&my_charset_latin1);
4973     str_result->length(length);
4974     break;
4975   }
4976   case DYN_COL_DATETIME:
4977   case DYN_COL_DATE:
4978   case DYN_COL_TIME:
4979   {
4980     int length;
4981     /*
4982       We use AUTO_SEC_PART_DIGITS here to ensure that we do not loose
4983       any microseconds from the data. This is safe to do as we are
4984       asked to return the time argument as a string.
4985     */
4986     if (str_result->alloc(MAX_DATE_STRING_REP_LENGTH) ||
4987         !(length= my_TIME_to_str(&val.x.time_value, (char*) str_result->ptr(),
4988                                  AUTO_SEC_PART_DIGITS)))
4989       goto null;
4990     str_result->set_charset(&my_charset_latin1);
4991     str_result->length(length);
4992     break;
4993   }
4994   }
4995   return str_result;
4996 
4997 null:
4998   null_value= TRUE;
4999   return 0;
5000 }
5001 
5002 
5003 longlong Item_dyncol_get::val_int()
5004 {
5005   THD *thd= current_thd;
5006   DYNAMIC_COLUMN_VALUE val;
5007   char buff[STRING_BUFFER_USUAL_SIZE];
5008   String tmp(buff, sizeof(buff), &my_charset_bin);
5009 
5010   if (get_dyn_value(thd, &val, &tmp))
5011     return 0;
5012 
5013   switch (val.type) {
5014   case DYN_COL_DYNCOL:
5015   case DYN_COL_NULL:
5016     goto null;
5017   case DYN_COL_UINT:
5018     unsigned_flag= 1;            // Make it possible for caller to detect sign
5019     return val.x.long_value;
5020   case DYN_COL_INT:
5021     unsigned_flag= 0;            // Make it possible for caller to detect sign
5022     return val.x.long_value;
5023   case DYN_COL_DOUBLE:
5024     return Converter_double_to_longlong_with_warn(thd, val.x.double_value,
5025                                                   unsigned_flag).result();
5026   case DYN_COL_STRING:
5027   {
5028     int error;
5029     longlong num;
5030     char *end= val.x.string.value.str + val.x.string.value.length, *org_end= end;
5031 
5032     num= my_strtoll10(val.x.string.value.str, &end, &error);
5033     if (unlikely(end != org_end || error > 0))
5034     {
5035       push_warning_printf(thd, Sql_condition::WARN_LEVEL_WARN,
5036                           ER_BAD_DATA,
5037                           ER_THD(thd, ER_BAD_DATA),
5038                           ErrConvString(val.x.string.value.str,
5039                                         val.x.string.value.length,
5040                                         val.x.string.charset).ptr(),
5041                           unsigned_flag ? "UNSIGNED INT" : "INT");
5042     }
5043     unsigned_flag= error >= 0;
5044     return num;
5045   }
5046   case DYN_COL_DECIMAL:
5047   {
5048     longlong num;
5049     my_decimal2int(E_DEC_FATAL_ERROR, &val.x.decimal.value, unsigned_flag,
5050                    &num);
5051     return num;
5052   }
5053   case DYN_COL_DATETIME:
5054   case DYN_COL_DATE:
5055   case DYN_COL_TIME:
5056     unsigned_flag= !val.x.time_value.neg;
5057     if (unsigned_flag)
5058       return TIME_to_ulonglong(&val.x.time_value);
5059     else
5060       return -(longlong)TIME_to_ulonglong(&val.x.time_value);
5061   }
5062 
5063 null:
5064   null_value= TRUE;
5065   return 0;
5066 }
5067 
5068 
5069 double Item_dyncol_get::val_real()
5070 {
5071   THD *thd= current_thd;
5072   DYNAMIC_COLUMN_VALUE val;
5073   char buff[STRING_BUFFER_USUAL_SIZE];
5074   String tmp(buff, sizeof(buff), &my_charset_bin);
5075 
5076   if (get_dyn_value(thd, &val, &tmp))
5077     return 0.0;
5078 
5079   switch (val.type) {
5080   case DYN_COL_DYNCOL:
5081   case DYN_COL_NULL:
5082     goto null;
5083   case DYN_COL_UINT:
5084     return ulonglong2double(val.x.ulong_value);
5085   case DYN_COL_INT:
5086     return (double) val.x.long_value;
5087   case DYN_COL_DOUBLE:
5088     return (double) val.x.double_value;
5089   case DYN_COL_STRING:
5090   {
5091     int error;
5092     char *end;
5093     double res= my_strntod(val.x.string.charset, (char*) val.x.string.value.str,
5094                            val.x.string.value.length, &end, &error);
5095 
5096     if (end != (char*) val.x.string.value.str + val.x.string.value.length ||
5097         error)
5098     {
5099       push_warning_printf(thd, Sql_condition::WARN_LEVEL_WARN,
5100                           ER_BAD_DATA,
5101                           ER_THD(thd, ER_BAD_DATA),
5102                           ErrConvString(val.x.string.value.str,
5103                                         val.x.string.value.length,
5104                                         val.x.string.charset).ptr(),
5105                           "DOUBLE");
5106     }
5107     return res;
5108   }
5109   case DYN_COL_DECIMAL:
5110   {
5111     double res;
5112     /* This will always succeed */
5113     decimal2double(&val.x.decimal.value, &res);
5114     return res;
5115   }
5116   case DYN_COL_DATETIME:
5117   case DYN_COL_DATE:
5118   case DYN_COL_TIME:
5119     return TIME_to_double(&val.x.time_value);
5120   }
5121 
5122 null:
5123   null_value= TRUE;
5124   return 0.0;
5125 }
5126 
5127 
5128 my_decimal *Item_dyncol_get::val_decimal(my_decimal *decimal_value)
5129 {
5130   THD *thd= current_thd;
5131   DYNAMIC_COLUMN_VALUE val;
5132   char buff[STRING_BUFFER_USUAL_SIZE];
5133   String tmp(buff, sizeof(buff), &my_charset_bin);
5134 
5135   if (get_dyn_value(thd, &val, &tmp))
5136     return NULL;
5137 
5138   switch (val.type) {
5139   case DYN_COL_DYNCOL:
5140   case DYN_COL_NULL:
5141     goto null;
5142   case DYN_COL_UINT:
5143     int2my_decimal(E_DEC_FATAL_ERROR, val.x.long_value, TRUE, decimal_value);
5144     break;
5145   case DYN_COL_INT:
5146     int2my_decimal(E_DEC_FATAL_ERROR, val.x.long_value, FALSE, decimal_value);
5147     break;
5148   case DYN_COL_DOUBLE:
5149     double2my_decimal(E_DEC_FATAL_ERROR, val.x.double_value, decimal_value);
5150     break;
5151   case DYN_COL_STRING:
5152   {
5153     const char *end;
5154     int rc;
5155     rc= str2my_decimal(0, val.x.string.value.str, val.x.string.value.length,
5156                        val.x.string.charset, decimal_value, &end);
5157     if (rc != E_DEC_OK ||
5158         end != val.x.string.value.str + val.x.string.value.length)
5159     {
5160       push_warning_printf(thd, Sql_condition::WARN_LEVEL_WARN,
5161                           ER_BAD_DATA,
5162                           ER_THD(thd, ER_BAD_DATA),
5163                           ErrConvString(val.x.string.value.str,
5164                                         val.x.string.value.length,
5165                                         val.x.string.charset).ptr(),
5166                           "DECIMAL");
5167     }
5168     break;
5169   }
5170   case DYN_COL_DECIMAL:
5171     decimal2my_decimal(&val.x.decimal.value, decimal_value);
5172     break;
5173   case DYN_COL_DATETIME:
5174   case DYN_COL_DATE:
5175   case DYN_COL_TIME:
5176     decimal_value= TIME_to_my_decimal(&val.x.time_value, decimal_value);
5177     break;
5178   }
5179   return decimal_value;
5180 
5181 null:
5182   null_value= TRUE;
5183   return 0;
5184 }
5185 
5186 
5187 bool Item_dyncol_get::get_date(MYSQL_TIME *ltime, ulonglong fuzzy_date)
5188 {
5189   DYNAMIC_COLUMN_VALUE val;
5190   char buff[STRING_BUFFER_USUAL_SIZE];
5191   String tmp(buff, sizeof(buff), &my_charset_bin);
5192   bool signed_value= 0;
5193 
5194   if (get_dyn_value(current_thd, &val, &tmp))
5195     return 1;                                   // Error
5196 
5197   switch (val.type) {
5198   case DYN_COL_DYNCOL:
5199   case DYN_COL_NULL:
5200     goto null;
5201   case DYN_COL_INT:
5202     signed_value= 1;                                  // For error message
5203     /* fall through */
5204   case DYN_COL_UINT:
5205     if (signed_value || val.x.ulong_value <= LONGLONG_MAX)
5206     {
5207       longlong llval = (longlong)val.x.ulong_value;
5208       bool neg = llval < 0;
5209       if (int_to_datetime_with_warn(neg, (ulonglong)(neg ? -llval :
5210                                                 llval),
5211                                     ltime, fuzzy_date, 0, 0 /* TODO */))
5212         goto null;
5213       return 0;
5214     }
5215     /* let double_to_datetime_with_warn() issue the warning message */
5216     val.x.double_value= static_cast<double>(ULONGLONG_MAX);
5217     /* fall through */
5218   case DYN_COL_DOUBLE:
5219     if (double_to_datetime_with_warn(val.x.double_value, ltime, fuzzy_date,
5220                                      0, 0 /* TODO */))
5221       goto null;
5222     return 0;
5223   case DYN_COL_DECIMAL:
5224     if (decimal_to_datetime_with_warn((my_decimal*)&val.x.decimal.value, ltime,
5225                                       fuzzy_date, 0, 0 /* TODO */))
5226       goto null;
5227     return 0;
5228   case DYN_COL_STRING:
5229     if (str_to_datetime_with_warn(&my_charset_numeric,
5230                                   val.x.string.value.str,
5231                                   val.x.string.value.length,
5232                                   ltime, fuzzy_date))
5233       goto null;
5234     return 0;
5235   case DYN_COL_DATETIME:
5236   case DYN_COL_DATE:
5237   case DYN_COL_TIME:
5238     *ltime= val.x.time_value;
5239     return 0;
5240   }
5241 
5242 null:
5243   null_value= TRUE;
5244   return 1;
5245 }
5246 
5247 void Item_dyncol_get::print(String *str, enum_query_type query_type)
5248 {
5249   /*
5250     Parent cast doesn't exist yet, only print dynamic column name. This happens
5251     when called from create_func_cast() / wrong_precision_error().
5252   */
5253   if (!str->length())
5254   {
5255     args[1]->print(str, query_type);
5256     return;
5257   }
5258 
5259   /* see create_func_dyncol_get */
5260   DBUG_ASSERT(str->length() >= 5);
5261   DBUG_ASSERT(strncmp(str->ptr() + str->length() - 5, "cast(", 5) == 0);
5262 
5263   str->length(str->length() - 5);    // removing "cast("
5264   str->append(STRING_WITH_LEN("column_get("));
5265   args[0]->print(str, query_type);
5266   str->append(',');
5267   args[1]->print(str, query_type);
5268   /* let the parent cast item add " as <type>)" */
5269 }
5270 
5271 
5272 String *Item_func_dyncol_list::val_str(String *str)
5273 {
5274   uint i;
5275   enum enum_dyncol_func_result rc;
5276   LEX_STRING *names= 0;
5277   uint count;
5278   DYNAMIC_COLUMN col;
5279   String *res= args[0]->val_str(str);
5280 
5281   if (args[0]->null_value)
5282     goto null;
5283   col.length= res->length();
5284   /* We do not change the string, so could do this trick */
5285   col.str= (char *)res->ptr();
5286   if ((rc= mariadb_dyncol_list_named(&col, &count, &names)))
5287   {
5288     bzero(&col, sizeof(col));
5289     dynamic_column_error_message(rc);
5290     goto null;
5291   }
5292   bzero(&col, sizeof(col));
5293 
5294   /*
5295     We estimate average name length as 10
5296   */
5297   if (str->alloc(count * 13))
5298     goto null;
5299 
5300   str->length(0);
5301   for (i= 0; i < count; i++)
5302   {
5303     append_identifier(current_thd, str, names[i].str, names[i].length);
5304     if (i < count - 1)
5305       str->qs_append(',');
5306   }
5307   null_value= FALSE;
5308   if (names)
5309     my_free(names);
5310   str->set_charset(DYNCOL_UTF);
5311   return str;
5312 
5313 null:
5314   null_value= TRUE;
5315   if (names)
5316     my_free(names);
5317   return NULL;
5318 }
5319 
5320 Item_temptable_rowid::Item_temptable_rowid(TABLE *table_arg)
5321   : Item_str_func(table_arg->in_use), table(table_arg)
5322 {
5323   max_length= table->file->ref_length;
5324 }
5325 
5326 bool Item_temptable_rowid::fix_length_and_dec()
5327 {
5328   used_tables_cache= table->map;
5329   const_item_cache= false;
5330   return FALSE;
5331 }
5332 
5333 String *Item_temptable_rowid::val_str(String *str)
5334 {
5335   if (!((null_value= table->null_row)))
5336     table->file->position(table->record[0]);
5337   str_value.set((char*)(table->file->ref), max_length, &my_charset_bin);
5338   return &str_value;
5339 }
5340