From fb36d923cea32705dff7d5221234ce948b13c17a Mon Sep 17 00:00:00 2001
From: unknown <pem@mysql.com>
Date: Fri, 10 Mar 2006 14:04:56 +0100
Subject: [PATCH] Fixed BUG#16474: SP crashed MySQL   fix_fields() was not
 called for "order by" variables if the type was a   "constant integer", and
 thus interpreted as a column index.   However, a local variable is an
 expression and should not be interpreted   as a column index. Instead it
 behaves just like when using a user variable   for instance (i.e. it will not
 affect the ordering).

mysql-test/r/sp.result:
  Updated results for new test case (BUG#16474).
mysql-test/t/sp.test:
  New test case for BUG#16474.
sql/sql_select.cc:
  When processing order list,
---
 mysql-test/r/sp.result | 29 +++++++++++++++++++++++++++++
 mysql-test/t/sp.test   | 31 +++++++++++++++++++++++++++++++
 sql/sql_select.cc      |  6 +++++-
 3 files changed, 65 insertions(+), 1 deletion(-)

diff --git a/mysql-test/r/sp.result b/mysql-test/r/sp.result
index b03c49b72e7..f19dbbd2689 100644
--- a/mysql-test/r/sp.result
+++ b/mysql-test/r/sp.result
@@ -4857,4 +4857,33 @@ i
 0
 drop table t3|
 drop procedure bug16887|
+drop procedure if exists bug16474_1|
+drop procedure if exists bug16474_2|
+delete from t1|
+insert into t1 values ('c', 2), ('b', 3), ('a', 1)|
+create procedure bug16474_1()
+begin
+declare x int;
+select id from t1 order by x;
+end|
+create procedure bug16474_2(x int)
+select id from t1 order by x|
+call bug16474_1()|
+id
+c
+b
+a
+call bug16474_2(1)|
+id
+c
+b
+a
+call bug16474_2(2)|
+id
+c
+b
+a
+drop procedure bug16474_1|
+drop procedure bug16474_2|
+delete from t1|
 drop table t1,t2;
diff --git a/mysql-test/t/sp.test b/mysql-test/t/sp.test
index e6823693b3d..af7ce57b252 100644
--- a/mysql-test/t/sp.test
+++ b/mysql-test/t/sp.test
@@ -5717,6 +5717,37 @@ drop table t3|
 drop procedure bug16887|
 
 
+#
+# BUG#16474: SP crashed MySQL
+# (when using "order by localvar", where 'localvar' is just that.
+#
+--disable_warnings
+drop procedure if exists bug16474_1|
+drop procedure if exists bug16474_2|
+--enable_warnings
+
+delete from t1|
+insert into t1 values ('c', 2), ('b', 3), ('a', 1)|
+
+create procedure bug16474_1()
+begin
+  declare x int;
+
+  select id from t1 order by x;
+end|
+
+# This does NOT order by column index; variable is an expression.
+create procedure bug16474_2(x int)
+  select id from t1 order by x|
+
+call bug16474_1()|
+call bug16474_2(1)|
+call bug16474_2(2)|
+drop procedure bug16474_1|
+drop procedure bug16474_2|
+delete from t1|
+
+
 #
 # BUG#NNNN: New bug synopsis
 #
diff --git a/sql/sql_select.cc b/sql/sql_select.cc
index 768ae7bf71f..eb92bd1177b 100644
--- a/sql/sql_select.cc
+++ b/sql/sql_select.cc
@@ -12325,7 +12325,11 @@ find_order_in_list(THD *thd, Item **ref_pointer_array, TABLE_LIST *tables,
   Item **select_item; /* The corresponding item from the SELECT clause. */
   Field *from_field;  /* The corresponding field from the FROM clause. */
 
-  if (order_item->type() == Item::INT_ITEM)
+  /*
+    Local SP variables may be int but are expressions, not positions.
+    (And they must be fixed.)
+  */
+  if (order_item->type() == Item::INT_ITEM && !order_item->is_splocal())
   {						/* Order by position */
     uint count= (uint) order_item->val_int();
     if (!count || count > fields.elements)