From 374dae3ecc49d948a95fb7b60be34837cc85a2b9 Mon Sep 17 00:00:00 2001
From: Vladislav Vaintroub <wlad@mariadb.com>
Date: Mon, 13 May 2019 14:31:15 +0000
Subject: [PATCH] MDEV-19452 - fix incorrect push_warning_printf

String is not guaranteed to be null-terminated, thus push_warning_printf
also needs to specify the length.
---
 sql/item_subselect.cc | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/sql/item_subselect.cc b/sql/item_subselect.cc
index 0e9b4a16c09..cb43362ac96 100644
--- a/sql/item_subselect.cc
+++ b/sql/item_subselect.cc
@@ -711,11 +711,14 @@ bool Item_subselect::exec()
   DBUG_ASSERT(fixed);
 
   DBUG_EXECUTE_IF("Item_subselect",
-                  push_warning_printf(thd, Sql_condition::WARN_LEVEL_NOTE,
-                  ER_UNKNOWN_ERROR, "DBUG: Item_subselect::exec %s",
-                  Item::Print(this,
-                              enum_query_type(QT_TO_SYSTEM_CHARSET |
-                                              QT_WITHOUT_INTRODUCERS)).ptr()););
+    Item::Print print(this,
+      enum_query_type(QT_TO_SYSTEM_CHARSET |
+        QT_WITHOUT_INTRODUCERS));
+
+    push_warning_printf(thd, Sql_condition::WARN_LEVEL_NOTE,
+       ER_UNKNOWN_ERROR, "DBUG: Item_subselect::exec %.*s",
+       print.length(),print.ptr());
+  );
   /*
     Do not execute subselect in case of a fatal error
     or if the query has been killed.