From 7b8717ace88805a6a243a2800fc7d3fc70d2fddc Mon Sep 17 00:00:00 2001
From: unknown <tnurnberg@mysql.com/white.intern.koehntopp.de>
Date: Sun, 24 Feb 2008 01:31:54 +0100
Subject: [PATCH] Bug#20752: BENCHMARK with many iterations returns too quickly

In BENCHMARK(count, expr), count could overflow/wrap-around.
Patch changes to a sufficiently large data-type. Adds a warning
for negative count values.


mysql-test/r/func_str.result:
  show that a negative 'count' for BENCHMARK(count, expr)
  throws a warning and returns NULL.
mysql-test/t/func_str.test:
  show that a negative 'count' for BENCHMARK(count, expr)
  throws a warning and returns NULL.
sql/item_func.cc:
  use ulonglong rather than ulong in BENCHMARK(count, expr)
  throw warning on negative 'count'; return SQL-NULL.
---
 mysql-test/r/func_str.result |  5 +++++
 mysql-test/t/func_str.test   |  7 +++++++
 sql/item_func.cc             | 18 ++++++++++++++----
 3 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/mysql-test/r/func_str.result b/mysql-test/r/func_str.result
index 6f6edd5112b..8bb764ad608 100644
--- a/mysql-test/r/func_str.result
+++ b/mysql-test/r/func_str.result
@@ -1431,6 +1431,11 @@ benchmark(100, NULL)
 select benchmark(NULL, 1+1);
 benchmark(NULL, 1+1)
 NULL
+select benchmark(-1, 1);
+benchmark(-1, 1)
+NULL
+Warnings:
+Error	1411	Incorrect count value: '-1' for function benchmark
 set @password="password";
 set @my_data="clear text to encode";
 select md5(encode(@my_data, "password"));
diff --git a/mysql-test/t/func_str.test b/mysql-test/t/func_str.test
index b6da14211ae..5a5f4024bc4 100644
--- a/mysql-test/t/func_str.test
+++ b/mysql-test/t/func_str.test
@@ -874,6 +874,13 @@ select benchmark(0, NULL);
 select benchmark(100, NULL);
 select benchmark(NULL, 1+1);
 
+#
+# Bug #20752: BENCHMARK with many iterations returns too quickly
+#
+
+# not a string, but belongs with the above Bug#22684
+select benchmark(-1, 1);
+
 #
 # Please note:
 # 1) The collation of the password is irrelevant, the encryption uses
diff --git a/sql/item_func.cc b/sql/item_func.cc
index cd936412241..f6f67b148bd 100644
--- a/sql/item_func.cc
+++ b/sql/item_func.cc
@@ -3651,18 +3651,28 @@ longlong Item_func_benchmark::val_int()
   String tmp(buff,sizeof(buff), &my_charset_bin);
   my_decimal tmp_decimal;
   THD *thd=current_thd;
-  ulong loop_count;
+  ulonglong loop_count;
 
-  loop_count= (ulong) args[0]->val_int();
+  loop_count= (ulonglong) args[0]->val_int();
 
-  if (args[0]->null_value)
+  if (args[0]->null_value ||
+      (!args[0]->unsigned_flag && (((longlong) loop_count) < 0)))
   {
+    if (!args[0]->null_value)
+    {
+      char buff[22];
+      llstr(((longlong) loop_count), buff);
+      push_warning_printf(current_thd, MYSQL_ERROR::WARN_LEVEL_ERROR,
+                          ER_WRONG_VALUE_FOR_TYPE, ER(ER_WRONG_VALUE_FOR_TYPE),
+                          "count", buff, "benchmark");
+    }
+
     null_value= 1;
     return 0;
   }
 
   null_value=0;
-  for (ulong loop=0 ; loop < loop_count && !thd->killed; loop++)
+  for (ulonglong loop=0 ; loop < loop_count && !thd->killed; loop++)
   {
     switch (args[1]->result_type()) {
     case REAL_RESULT: