diff --git a/mysql-test/r/func_misc.result b/mysql-test/r/func_misc.result
index 8d05adcc1ba..d51bea020ed 100644
--- a/mysql-test/r/func_misc.result
+++ b/mysql-test/r/func_misc.result
@@ -13,3 +13,6 @@ NULL	255.255.1.255	0.0.1.255
 select length(format('nan', 2)) > 0;
 length(format('nan', 2)) > 0
 1
+select concat("$",format(2500,2));
+concat("$",format(2500,2))
+$2,500.00
diff --git a/mysql-test/t/func_misc.test b/mysql-test/t/func_misc.test
index be64c170fa1..d15c26279ec 100644
--- a/mysql-test/t/func_misc.test
+++ b/mysql-test/t/func_misc.test
@@ -12,3 +12,8 @@ select inet_ntoa(1099511627775),inet_ntoa(4294902271),inet_ntoa(511);
 # Test for core dump with nan
 #
 select length(format('nan', 2)) > 0;
+
+#
+# Test for bug #628
+#
+select concat("$",format(2500,2));
diff --git a/sql/item_strfunc.cc b/sql/item_strfunc.cc
index d18436d2c61..838fca807a2 100644
--- a/sql/item_strfunc.cc
+++ b/sql/item_strfunc.cc
@@ -1483,7 +1483,7 @@ String *Item_func_format::val_str(String *str)
     str= copy_if_not_alloced(&tmp_str,str,length);
     str->length(length);
     tmp= (char*) str->ptr()+length - dec-1;
-    for (pos= (char*) str->ptr()+length ; pos != tmp; pos--)
+    for (pos= (char*) str->ptr()+length-1; pos != tmp; pos--)
       pos[0]= pos[-(int) diff];
     while (diff)
     {