From 681a2d1a53999f70e5437f62d8478caade48f3b3 Mon Sep 17 00:00:00 2001
From: Sergey Glukhov <Sergey.Glukhov@sun.com>
Date: Tue, 9 Dec 2008 14:00:43 +0400
Subject: [PATCH] bug#35558 Wrong server metadata blows up the client the
 problem: FORMAT func max_length value was calculated incorrectly the fix:
 correct calculation of max_length

mysql-test/r/func_str.result:
  test result
mysql-test/t/func_str.test:
  test case
sql/item_strfunc.h:
  the problem: FORMAT func max_length value was calculated incorrectly
  the fix: correct calculation of max_length
---
 mysql-test/r/func_str.result | 12 +++++++++---
 mysql-test/t/func_str.test   | 10 ++++++++++
 sql/item_strfunc.h           |  5 +++--
 3 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/mysql-test/r/func_str.result b/mysql-test/r/func_str.result
index d0809eca65b..c121c8937d7 100644
--- a/mysql-test/r/func_str.result
+++ b/mysql-test/r/func_str.result
@@ -717,8 +717,6 @@ insert(_latin2'abcd',2,3,_latin2'ef'),
 replace(_latin2'abcd',_latin2'b',_latin2'B'),
 encode('abcd','ab')
 ;
-Warnings:
-Warning	1265	Data truncated for column 'format(130,10)' at row 1
 show create table t1;
 Table	Create Table
 t1	CREATE TABLE `t1` (
@@ -727,7 +725,7 @@ t1	CREATE TABLE `t1` (
   `conv(130,16,10)` varchar(64) default NULL,
   `hex(130)` varchar(6) NOT NULL default '',
   `char(130)` varbinary(4) NOT NULL default '',
-  `format(130,10)` varchar(4) NOT NULL default '',
+  `format(130,10)` varchar(16) NOT NULL default '',
   `left(_latin2'a',1)` varchar(1) character set latin2 NOT NULL default '',
   `right(_latin2'a',1)` varchar(1) character set latin2 NOT NULL default '',
   `lcase(_latin2'a')` varchar(1) character set latin2 NOT NULL default '',
@@ -2175,4 +2173,12 @@ SELECT HEX(c1) from v1;
 HEX(c1)
 414243
 DROP VIEW v1;
+create table t1(a float);
+insert into t1 values (1.33);
+select format(a, 2) from t1;
+Catalog	Database	Table	Table_alias	Column	Column_alias	Type	Length	Max length	Is_null	Flags	Decimals	Charsetnr
+def					format(a, 2)	253	20	4	Y	0	2	8
+format(a, 2)
+1.33
+drop table t1;
 End of 5.0 tests
diff --git a/mysql-test/t/func_str.test b/mysql-test/t/func_str.test
index 1ca2bbfaf4c..8298a50c277 100644
--- a/mysql-test/t/func_str.test
+++ b/mysql-test/t/func_str.test
@@ -1149,4 +1149,14 @@ CREATE VIEW v1 AS SELECT CHAR(0x414243) as c1;
 SELECT HEX(c1) from v1;
 DROP VIEW v1;
 
+#
+# Bug #35558 Wrong server metadata blows up the client
+#
+create table t1(a float);
+insert into t1 values (1.33);
+--enable_metadata
+select format(a, 2) from t1;
+--disable_metadata
+drop table t1;
+
 --echo End of 5.0 tests
diff --git a/sql/item_strfunc.h b/sql/item_strfunc.h
index 3648438a69b..23ac20a4017 100644
--- a/sql/item_strfunc.h
+++ b/sql/item_strfunc.h
@@ -516,8 +516,9 @@ public:
   {
     collation.set(default_charset());
     uint char_length= args[0]->max_length/args[0]->collation.collation->mbmaxlen;
-    max_length= ((char_length + (char_length-args[0]->decimals)/3) *
-                 collation.collation->mbmaxlen);
+    uint max_sep_count= char_length/3 + (decimals ? 1 : 0) + /*sign*/1;
+    max_length= (char_length + max_sep_count + decimals) *
+      collation.collation->mbmaxlen;
   }
   const char *func_name() const { return "format"; }
   void print(String *);