Merge remote-tracking branch 'origin/10.2' into 10.3

19 files changed, 270 insertions, 24 deletions

diff --git a/extra/mariabackup/xtrabackup.cc b/extra/mariabackup/xtrabackup.cc
index 7aa32083ab0..e8dee510f63 100644
--- a/extra/mariabackup/xtrabackup.cc
+++ b/extra/mariabackup/xtrabackup.cc
@@ -4,7 +4,7 @@ MariaBackup: hot backup tool for InnoDB
 Originally Created 3/3/2009 Yasufumi Kinoshita
 Written by Alexey Kopytov, Aleksandr Kuzminsky, Stewart Smith, Vadim Tkachenko,
 Yasufumi Kinoshita, Ignacio Nin and Baron Schwartz.
-(c) 2017, 2018, MariaDB Corporation.
+(c) 2017, 2019, MariaDB Corporation.
 Portions written by Marko Mäkelä.
 
 This program is free software; you can redistribute it and/or modify
@@ -5371,8 +5371,7 @@ static ibool prepare_handle_del_files(const char *datadir, const char *db, const
 
 /** Implement --prepare
 @return	whether the operation succeeded */
-static bool
-xtrabackup_prepare_func(char** argv)
+static bool xtrabackup_prepare_func(char** argv)
 {
 	char			 metadata_path[FN_REFLEN];
 
diff --git a/mysql-test/main/func_math.result b/mysql-test/main/func_math.result
index 251979dba03..db9b16f5507 100644
--- a/mysql-test/main/func_math.result
+++ b/mysql-test/main/func_math.result
@@ -826,6 +826,49 @@ SELECT STDDEV_POP(ROUND(0,@A:=2009)) FROM (SELECT 1 UNION SELECT 2) fake_table;
 STDDEV_POP(ROUND(0,@A:=2009))
 0.0000
 #
+# Start of 10.1 tests
+#
+#
+# MDEV-17643 Assertion `nr >= 0.0' failed in Item_sum_std::val_real()
+#
+CREATE TABLE t1 ( pk int NOT NULL, i1 int NOT NULL, d1 date NOT NULL, t1 time);
+INSERT INTO t1 VALUES (7,9,'2007-08-15','03:55:02'),(8,7,'1993-06-05','04:17:51'),(9,7,'2034-07-01','17:31:12'),(10,0,'1998-08-24','08:09:27');
+SELECT DISTINCT  STDDEV_SAMP(EXPORT_SET(t1, -1379790335835635712, (i1 + 'o'), (MD5(d1)))) FROM t1;
+STDDEV_SAMP(EXPORT_SET(t1, -1379790335835635712, (i1 + 'o'), (MD5(d1))))
+NULL
+Warnings:
+Warning	1292	Truncated incorrect DOUBLE value: 'o'
+Warning	1292	Truncated incorrect DOUBLE value: '98e466c7ff40fe6b95cde24200f376303-13797903358356357128e466c7ff40fe6b95cde24200f376303-13797903358356357128e466c7ff40fe6b95cde242'
+Warning	1292	Truncated incorrect DOUBLE value: 'o'
+Warning	1292	Truncated incorrect DOUBLE value: '-1379790335835635712e315457d879863c6ccf2ddee5562fc24-1379790335835635712e315457d879863c6ccf2ddee5562fc24-1379790335835635712e315'
+Warning	1292	Truncated incorrect DOUBLE value: 'o'
+Warning	1292	Truncated incorrect DOUBLE value: '7b4dd517b633f1f6304b773523b5279747b4dd517b633f1f6304b773523b5279747b4dd517b633f1f6304b773523b527974-1379790335835635712b4dd517b6'
+Warning	1292	Truncated incorrect DOUBLE value: 'o'
+Warning	1292	Truncated incorrect DOUBLE value: '-1379790335835635712b0e107767ea830fd3318893e40412a43-1379790335835635712b0e107767ea830fd3318893e40412a43-1379790335835635712b0e1'
+DROP TABLE t1;
+CREATE TABLE t1 (a VARCHAR(128));
+INSERT INTO t1 VALUES ('1e310');
+INSERT INTO t1 VALUES ('-1e310');
+INSERT INTO t1 VALUES ('0');
+SELECT STDDEV_SAMP(a) FROM t1;
+STDDEV_SAMP(a)
+NULL
+Warnings:
+Warning	1292	Truncated incorrect DOUBLE value: '1e310'
+Warning	1292	Truncated incorrect DOUBLE value: '-1e310'
+DROP TABLE t1;
+CREATE OR REPLACE TABLE t1 (a DOUBLE);
+INSERT INTO t1 VALUES (1.7e+308);
+INSERT INTO t1 VALUES (-1.7e+308);
+INSERT INTO t1 VALUES (0);
+SELECT STDDEV_SAMP(a) FROM t1;
+STDDEV_SAMP(a)
+NULL
+DROP TABLE t1;
+#
+# End of 10.1 tests
+#
+#
 # Start of 10.2 tests
 #
 # Test zero
diff --git a/mysql-test/main/func_math.test b/mysql-test/main/func_math.test
index 5d7c593a63d..1e8e6cfbb70 100644
--- a/mysql-test/main/func_math.test
+++ b/mysql-test/main/func_math.test
@@ -597,6 +597,37 @@ DROP TABLE t1;
 SELECT STDDEV_POP(ROUND(0,@A:=2009)) FROM (SELECT 1 UNION SELECT 2) fake_table;
 
 --echo #
+--echo # Start of 10.1 tests
+--echo #
+
+--echo #
+--echo # MDEV-17643 Assertion `nr >= 0.0' failed in Item_sum_std::val_real()
+--echo #
+
+CREATE TABLE t1 ( pk int NOT NULL, i1 int NOT NULL, d1 date NOT NULL, t1 time);
+INSERT INTO t1 VALUES (7,9,'2007-08-15','03:55:02'),(8,7,'1993-06-05','04:17:51'),(9,7,'2034-07-01','17:31:12'),(10,0,'1998-08-24','08:09:27');
+SELECT DISTINCT  STDDEV_SAMP(EXPORT_SET(t1, -1379790335835635712, (i1 + 'o'), (MD5(d1)))) FROM t1;
+DROP TABLE t1;
+
+CREATE TABLE t1 (a VARCHAR(128));
+INSERT INTO t1 VALUES ('1e310');
+INSERT INTO t1 VALUES ('-1e310');
+INSERT INTO t1 VALUES ('0');
+SELECT STDDEV_SAMP(a) FROM t1;
+DROP TABLE t1;
+
+CREATE OR REPLACE TABLE t1 (a DOUBLE);
+INSERT INTO t1 VALUES (1.7e+308);
+INSERT INTO t1 VALUES (-1.7e+308);
+INSERT INTO t1 VALUES (0);
+SELECT STDDEV_SAMP(a) FROM t1;
+DROP TABLE t1;
+
+--echo #
+--echo # End of 10.1 tests
+--echo #
+
+--echo #
 --echo # Start of 10.2 tests
 --echo #
 
diff --git a/mysql-test/main/func_str.result b/mysql-test/main/func_str.result
index 07dca08c819..f1da28d10be 100644
--- a/mysql-test/main/func_str.result
+++ b/mysql-test/main/func_str.result
@@ -3165,6 +3165,77 @@ select md5(_filename "a"), sha(_filename "a");
 md5(_filename "a")	sha(_filename "a")
 0cc175b9c0f1b6a831c399e269772661	86f7e437faa5a7fce15d1ddcb9eaeaea377667b8
 #
+# MDEV-18881 Assertion `0' failed in make_sortkey upon SELECT with GROUP BY after LOAD DATA
+#
+CREATE TABLE t1 (a BIT(22), b CHAR(8) NOT NULL, c CHAR(8));
+INSERT INTO t1 VALUES (0xA4B,'foo','qux');
+INSERT INTO t1 VALUES (0x8F5,'bar','foobar');
+INSERT INTO t1 VALUES (0x0, '', NULL);
+INSERT INTO t1 VALUES (0x4B, 'foo','qux');
+INSERT INTO t1 VALUES (0x8F5, 'bar', 'foobar');
+SET SESSION SQL_MODE= '';
+SELECT GROUP_CONCAT(c) AS f FROM t1 GROUP BY LPAD('foo', 20, b);
+f
+NULL
+foobar,foobar
+qux,qux
+DROP TABLE t1;
+SET SESSION SQL_MODE=DEFAULT;
+CREATE TABLE t1 AS SELECT
+LPAD('a',10,' '),
+RPAD('a',10,' '),
+LPAD('a',10,'  '),
+RPAD('a',10,'  '),
+LPAD('a',10,NULL),
+RPAD('a',10,NULL),
+LPAD('a',10,''),
+RPAD('a',10,''),
+LPAD('a',10,RAND()),
+RPAD('a',10,RAND());
+SHOW CREATE TABLE t1;
+Table	Create Table
+t1	CREATE TABLE `t1` (
+  `LPAD('a',10,' ')` varchar(10) DEFAULT NULL,
+  `RPAD('a',10,' ')` varchar(10) DEFAULT NULL,
+  `LPAD('a',10,'  ')` varchar(10) DEFAULT NULL,
+  `RPAD('a',10,'  ')` varchar(10) DEFAULT NULL,
+  `LPAD('a',10,NULL)` varchar(10) DEFAULT NULL,
+  `RPAD('a',10,NULL)` varchar(10) DEFAULT NULL,
+  `LPAD('a',10,'')` varchar(10) DEFAULT NULL,
+  `RPAD('a',10,'')` varchar(10) DEFAULT NULL,
+  `LPAD('a',10,RAND())` varchar(10) DEFAULT NULL,
+  `RPAD('a',10,RAND())` varchar(10) DEFAULT NULL
+) ENGINE=MyISAM DEFAULT CHARSET=latin1
+DROP TABLE t1;
+SET SESSION SQL_MODE= '';
+CREATE TABLE t1 AS SELECT
+LPAD('a',10,' '),
+RPAD('a',10,' '),
+LPAD('a',10,'  '),
+RPAD('a',10,'  '),
+LPAD('a',10,NULL),
+RPAD('a',10,NULL),
+LPAD('a',10,''),
+RPAD('a',10,''),
+LPAD('a',10,RAND()),
+RPAD('a',10,RAND());
+SHOW CREATE TABLE t1;
+Table	Create Table
+t1	CREATE TABLE `t1` (
+  `LPAD('a',10,' ')` varchar(10) NOT NULL,
+  `RPAD('a',10,' ')` varchar(10) NOT NULL,
+  `LPAD('a',10,'  ')` varchar(10) NOT NULL,
+  `RPAD('a',10,'  ')` varchar(10) NOT NULL,
+  `LPAD('a',10,NULL)` varchar(10) DEFAULT NULL,
+  `RPAD('a',10,NULL)` varchar(10) DEFAULT NULL,
+  `LPAD('a',10,'')` varchar(10) DEFAULT NULL,
+  `RPAD('a',10,'')` varchar(10) DEFAULT NULL,
+  `LPAD('a',10,RAND())` varchar(10) DEFAULT NULL,
+  `RPAD('a',10,RAND())` varchar(10) DEFAULT NULL
+) ENGINE=MyISAM DEFAULT CHARSET=latin1
+DROP TABLE t1;
+SET SESSION SQL_MODE=DEFAULT;
+#
 # End of 5.5 tests
 #
 #
diff --git a/mysql-test/main/func_str.test b/mysql-test/main/func_str.test
index 4165e147768..64aca38c115 100644
--- a/mysql-test/main/func_str.test
+++ b/mysql-test/main/func_str.test
@@ -1664,6 +1664,51 @@ drop table t1,t2;
 select md5(_filename "a"), sha(_filename "a");
 
 --echo #
+--echo # MDEV-18881 Assertion `0' failed in make_sortkey upon SELECT with GROUP BY after LOAD DATA
+--echo #
+
+CREATE TABLE t1 (a BIT(22), b CHAR(8) NOT NULL, c CHAR(8));
+INSERT INTO t1 VALUES (0xA4B,'foo','qux');
+INSERT INTO t1 VALUES (0x8F5,'bar','foobar');
+INSERT INTO t1 VALUES (0x0, '', NULL);
+INSERT INTO t1 VALUES (0x4B, 'foo','qux');
+INSERT INTO t1 VALUES (0x8F5, 'bar', 'foobar');
+SET SESSION SQL_MODE= '';
+SELECT GROUP_CONCAT(c) AS f FROM t1 GROUP BY LPAD('foo', 20, b);
+DROP TABLE t1;
+SET SESSION SQL_MODE=DEFAULT;
+
+CREATE TABLE t1 AS SELECT
+  LPAD('a',10,' '),
+  RPAD('a',10,' '),
+  LPAD('a',10,'  '),
+  RPAD('a',10,'  '),
+  LPAD('a',10,NULL),
+  RPAD('a',10,NULL),
+  LPAD('a',10,''),
+  RPAD('a',10,''),
+  LPAD('a',10,RAND()),
+  RPAD('a',10,RAND());
+SHOW CREATE TABLE t1;
+DROP TABLE t1;
+SET SESSION SQL_MODE= '';
+CREATE TABLE t1 AS SELECT
+  LPAD('a',10,' '),
+  RPAD('a',10,' '),
+  LPAD('a',10,'  '),
+  RPAD('a',10,'  '),
+  LPAD('a',10,NULL),
+  RPAD('a',10,NULL),
+  LPAD('a',10,''),
+  RPAD('a',10,''),
+  LPAD('a',10,RAND()),
+  RPAD('a',10,RAND());
+SHOW CREATE TABLE t1;
+DROP TABLE t1;
+SET SESSION SQL_MODE=DEFAULT;
+
+
+--echo #
 --echo # End of 5.5 tests
 --echo #
 
diff --git a/mysql-test/main/log_slow_debug.result b/mysql-test/main/log_slow_debug.result
index 7265346b36c..6409aed8535 100644
--- a/mysql-test/main/log_slow_debug.result
+++ b/mysql-test/main/log_slow_debug.result
@@ -14,6 +14,14 @@ FROM mysql.slow_log
 WHERE sql_text NOT LIKE '%debug_dbug%';
 END
 $$
+CREATE PROCEDURE show_slow_log_exclude_ps()
+BEGIN
+SELECT CONCAT('[slow] ', sql_text) AS sql_text
+FROM mysql.slow_log
+WHERE sql_text NOT LIKE '%debug_dbug%'
+       AND sql_text NOT IN ('Prepare','Close stmt');
+END
+$$
 #
 # Expect all admin statements in the slow log (ON,DEFAULT)
 #
@@ -33,7 +41,7 @@ PREPARE stmt FROM 'ALTER TABLE t4 MODIFY a INT DEFAULT 1';
 EXECUTE stmt;
 DEALLOCATE PREPARE stmt;
 DROP TABLE t4;
-CALL show_slow_log();
+CALL show_slow_log_exclude_ps();
 sql_text
 [slow] TRUNCATE TABLE mysql.slow_log
 [slow] CREATE TABLE t1 (a INT)
@@ -115,7 +123,7 @@ PREPARE stmt FROM 'ALTER TABLE t4 MODIFY a INT DEFAULT 1';
 EXECUTE stmt;
 DEALLOCATE PREPARE stmt;
 DROP TABLE t4;
-CALL show_slow_log();
+CALL show_slow_log_exclude_ps();
 sql_text
 [slow] TRUNCATE TABLE mysql.slow_log
 [slow] CREATE TABLE t1 (a INT)
@@ -140,3 +148,4 @@ SET @@global.slow_query_log= @org_slow_query_log;
 SET @@global.log_output= @org_log_output;
 SET @@global.log_slow_admin_statements= @org_log_slow_admin_statements;
 DROP PROCEDURE show_slow_log;
+DROP PROCEDURE show_slow_log_exclude_ps;
diff --git a/mysql-test/main/log_slow_debug.test b/mysql-test/main/log_slow_debug.test
index 35b5b93423d..7945328fee3 100644
--- a/mysql-test/main/log_slow_debug.test
+++ b/mysql-test/main/log_slow_debug.test
@@ -19,6 +19,14 @@ BEGIN
      WHERE sql_text NOT LIKE '%debug_dbug%';
 END
 $$
+CREATE PROCEDURE show_slow_log_exclude_ps()
+BEGIN
+  SELECT CONCAT('[slow] ', sql_text) AS sql_text
+    FROM mysql.slow_log
+     WHERE sql_text NOT LIKE '%debug_dbug%'
+       AND sql_text NOT IN ('Prepare','Close stmt');
+END
+$$
 DELIMITER ;$$
 
 
@@ -42,7 +50,7 @@ PREPARE stmt FROM 'ALTER TABLE t4 MODIFY a INT DEFAULT 1';
 EXECUTE stmt;
 DEALLOCATE PREPARE stmt;
 DROP TABLE t4;
-CALL show_slow_log();
+CALL show_slow_log_exclude_ps();
 
 
 --echo #
@@ -111,7 +119,7 @@ PREPARE stmt FROM 'ALTER TABLE t4 MODIFY a INT DEFAULT 1';
 EXECUTE stmt;
 DEALLOCATE PREPARE stmt;
 DROP TABLE t4;
-CALL show_slow_log();
+CALL show_slow_log_exclude_ps();
 
 
 --echo #
@@ -124,3 +132,4 @@ SET @@global.slow_query_log= @org_slow_query_log;
 SET @@global.log_output= @org_log_output;
 SET @@global.log_slow_admin_statements= @org_log_slow_admin_statements;
 DROP PROCEDURE show_slow_log;
+DROP PROCEDURE show_slow_log_exclude_ps;
diff --git a/mysql-test/main/subselect_sj.result b/mysql-test/main/subselect_sj.result
index b50ae942899..454a09771f6 100644
--- a/mysql-test/main/subselect_sj.result
+++ b/mysql-test/main/subselect_sj.result
@@ -3190,5 +3190,12 @@ EXECUTE stmt;
 a
 drop view v3;
 drop table t1,t2,t3;
+#
+# MDEV-18896: IN subquery in WHERE of a table-less query used for INSERT
+#
+create table t1 (a1 varchar(25));
+create table t2 (a2 varchar(25)) ;
+insert into t1 select 'xxx' from dual where 'xxx' in (select a2 from t2);
+drop table t1,t2;
 # End of 5.5 test
 set optimizer_switch=@subselect_sj_tmp;
diff --git a/mysql-test/main/subselect_sj.test b/mysql-test/main/subselect_sj.test
index 04770761553..e4e31691843 100644
--- a/mysql-test/main/subselect_sj.test
+++ b/mysql-test/main/subselect_sj.test
@@ -2874,6 +2874,16 @@ EXECUTE stmt;
 drop view v3;
 drop table t1,t2,t3;
 
+--echo #
+--echo # MDEV-18896: IN subquery in WHERE of a table-less query used for INSERT
+--echo #
+
+create table t1 (a1 varchar(25));
+create table t2 (a2 varchar(25)) ;
+insert into t1 select 'xxx' from dual where 'xxx' in (select a2 from t2);
+
+drop table t1,t2;
+
 --echo # End of 5.5 test
 
 # The following command must be the last one the file 
diff --git a/mysql-test/main/subselect_sj_jcl6.result b/mysql-test/main/subselect_sj_jcl6.result
index d7b77be7b54..fc279b05ac2 100644
--- a/mysql-test/main/subselect_sj_jcl6.result
+++ b/mysql-test/main/subselect_sj_jcl6.result
@@ -3204,6 +3204,13 @@ EXECUTE stmt;
 a
 drop view v3;
 drop table t1,t2,t3;
+#
+# MDEV-18896: IN subquery in WHERE of a table-less query used for INSERT
+#
+create table t1 (a1 varchar(25));
+create table t2 (a2 varchar(25)) ;
+insert into t1 select 'xxx' from dual where 'xxx' in (select a2 from t2);
+drop table t1,t2;
 # End of 5.5 test
 set optimizer_switch=@subselect_sj_tmp;
 #
diff --git a/mysql-test/mysql-test-run.pl b/mysql-test/mysql-test-run.pl
index 9e394cebfff..a166330d813 100755
--- a/mysql-test/mysql-test-run.pl
+++ b/mysql-test/mysql-test-run.pl
@@ -199,8 +199,6 @@ my @DEFAULT_SUITES= qw(
     unit-
     vcol-
     versioning-
-    wsrep-
-    galera-
   );
 my $opt_suites;
 
diff --git a/plugin/auth_pam/auth_pam.c b/plugin/auth_pam/auth_pam.c
index ffc3d6f5537..a6a981f9641 100644
--- a/plugin/auth_pam/auth_pam.c
+++ b/plugin/auth_pam/auth_pam.c
@@ -1,5 +1,5 @@
 /*
-   Copyright (c) 2011, 2012, Monty Program Ab
+   Copyright (c) 2011, 2019, MariaDB Corporation.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -161,7 +161,7 @@ static int pam_auth(MYSQL_PLUGIN_VIO *vio, MYSQL_SERVER_AUTH_INFO *info)
 
   if (new_username && strcmp(new_username, info->user_name))
     strncpy(info->authenticated_as, new_username,
-            sizeof(info->authenticated_as));
+            sizeof(info->authenticated_as)-1);
   info->authenticated_as[sizeof(info->authenticated_as)-1]= 0;
 
 end:
diff --git a/plugin/server_audit/server_audit.c b/plugin/server_audit/server_audit.c
index 72d5a91d59d..c655e02a4fc 100644
--- a/plugin/server_audit/server_audit.c
+++ b/plugin/server_audit/server_audit.c
@@ -1055,7 +1055,7 @@ static int start_logging()
     }
     error_header();
     fprintf(stderr, "logging started to the file %s.\n", alt_fname);
-    strncpy(current_log_buf, alt_fname, sizeof(current_log_buf));
+    strncpy(current_log_buf, alt_fname, sizeof(current_log_buf)-1);
     current_log_buf[sizeof(current_log_buf)-1]= 0;
   }
   else if (output_type == OUTPUT_SYSLOG)
@@ -1063,7 +1063,8 @@ static int start_logging()
     openlog(syslog_ident, LOG_NOWAIT, syslog_facility_codes[syslog_facility]);
     error_header();
     fprintf(stderr, "logging started to the syslog.\n");
-    strncpy(current_log_buf, "[SYSLOG]", sizeof(current_log_buf));
+    strncpy(current_log_buf, "[SYSLOG]", sizeof(current_log_buf)-1);
+    compile_time_assert(sizeof current_log_buf > sizeof "[SYSLOG]");
   }
   is_active= 1;
   return 0;
@@ -2600,7 +2601,7 @@ static void update_file_path(MYSQL_THD thd,
     internal_stop_logging= 0;
   }
 
-  strncpy(path_buffer, new_name, sizeof(path_buffer));
+  strncpy(path_buffer, new_name, sizeof(path_buffer)-1);
   path_buffer[sizeof(path_buffer)-1]= 0;
   file_path= path_buffer;
 exit_func:
@@ -2653,7 +2654,7 @@ static void update_incl_users(MYSQL_THD thd,
   if (!maria_55_started || !debug_server_started)
     flogger_mutex_lock(&lock_operations);
   mark_always_logged(thd);
-  strncpy(incl_user_buffer, new_users, sizeof(incl_user_buffer));
+  strncpy(incl_user_buffer, new_users, sizeof(incl_user_buffer)-1);
   incl_user_buffer[sizeof(incl_user_buffer)-1]= 0;
   incl_users= incl_user_buffer;
   user_coll_fill(&incl_user_coll, incl_users, &excl_user_coll, 1);
@@ -2672,7 +2673,7 @@ static void update_excl_users(MYSQL_THD thd  __attribute__((unused)),
   if (!maria_55_started || !debug_server_started)
     flogger_mutex_lock(&lock_operations);
   mark_always_logged(thd);
-  strncpy(excl_user_buffer, new_users, sizeof(excl_user_buffer));
+  strncpy(excl_user_buffer, new_users, sizeof(excl_user_buffer)-1);
   excl_user_buffer[sizeof(excl_user_buffer)-1]= 0;
   excl_users= excl_user_buffer;
   user_coll_fill(&excl_user_coll, excl_users, &incl_user_coll, 0);
@@ -2804,7 +2805,7 @@ static void update_syslog_ident(MYSQL_THD thd  __attribute__((unused)),
               void *var_ptr  __attribute__((unused)), const void *save)
 {
   char *new_ident= (*(char **) save) ? *(char **) save : empty_str;
-  strncpy(syslog_ident_buffer, new_ident, sizeof(syslog_ident_buffer));
+  strncpy(syslog_ident_buffer, new_ident, sizeof(syslog_ident_buffer)-1);
   syslog_ident_buffer[sizeof(syslog_ident_buffer)-1]= 0;
   syslog_ident= syslog_ident_buffer;
   error_header();
diff --git a/sql/item_strfunc.cc b/sql/item_strfunc.cc
index 8e4f4232959..d6f3a282671 100644
--- a/sql/item_strfunc.cc
+++ b/sql/item_strfunc.cc
@@ -1,6 +1,6 @@
 /*
    Copyright (c) 2000, 2017, Oracle and/or its affiliates.
-   Copyright (c) 2009, 2018, MariaDB Corporation
+   Copyright (c) 2009, 2019, MariaDB Corporation
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -3166,6 +3166,9 @@ bool Item_func_pad::fix_length_and_dec()
 {
   if (arg_count == 3)
   {
+    String *str;
+    if (!args[2]->basic_const_item() || !(str= args[2]->val_str(&pad_str)) || !str->length())
+      maybe_null= true;
     // Handle character set for args[0] and args[2].
     if (agg_arg_charsets_for_string_result(collation, &args[0], 2, 2))
       return TRUE;
diff --git a/sql/item_strfunc.h b/sql/item_strfunc.h
index a458ff53d11..56417f6d638 100644
--- a/sql/item_strfunc.h
+++ b/sql/item_strfunc.h
@@ -3,7 +3,7 @@
 
 /*
    Copyright (c) 2000, 2011, Oracle and/or its affiliates.
-   Copyright (c) 2009, 2015, MariaDB
+   Copyright (c) 2009, 2019, MariaDB
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/sql/item_sum.cc b/sql/item_sum.cc
index 44e5a86c863..eb6d71cf99b 100644
--- a/sql/item_sum.cc
+++ b/sql/item_sum.cc
@@ -2046,6 +2046,18 @@ double Item_sum_std::val_real()
 {
   DBUG_ASSERT(fixed == 1);
   double nr= Item_sum_variance::val_real();
+  if (isnan(nr))
+  {
+    /*
+      variance_fp_recurrence_next() can overflow in some cases and return "nan":
+
+      CREATE OR REPLACE TABLE t1 (a DOUBLE);
+      INSERT INTO t1 VALUES (1.7e+308), (-1.7e+308), (0);
+      SELECT STDDEV_SAMP(a) FROM t1;
+    */
+    null_value= true; // Convert "nan" to NULL
+    return 0;
+  }
   if (std::isinf(nr))
     return DBL_MAX;
   DBUG_ASSERT(nr >= 0.0);
@@ -2093,8 +2105,9 @@ static void variance_fp_recurrence_next(double *m, double *s, ulonglong *count,
   else
   {
     double m_kminusone= *m;
-    *m= m_kminusone + (nr - m_kminusone) / (double) *count;
-    *s= *s + (nr - m_kminusone) * (nr - *m);
+    volatile double diff= nr - m_kminusone;
+    *m= m_kminusone + diff / (double) *count;
+    *s= *s + diff * (nr - *m);
   }
 }
 
diff --git a/sql/opt_subselect.cc b/sql/opt_subselect.cc
index 13c0ce0c157..e66695ab9b0 100644
--- a/sql/opt_subselect.cc
+++ b/sql/opt_subselect.cc
@@ -673,7 +673,7 @@ int check_and_do_in_subquery_rewrites(JOIN *join)
         select_lex->outer_select()->join &&                           // 6
         parent_unit->first_select()->leaf_tables.elements &&          // 7
         !in_subs->has_strategy() &&                                   // 8
-        select_lex->outer_select()->leaf_tables.elements &&           // 9
+        select_lex->outer_select()->table_list.first &&               // 9
         !((join->select_options |                                     // 10
            select_lex->outer_select()->join->select_options)          // 10
           & SELECT_STRAIGHT_JOIN) &&                                  // 10
diff --git a/sql/wsrep_binlog.cc b/sql/wsrep_binlog.cc
index 0cbcdcd64aa..b823f9e70d3 100644
--- a/sql/wsrep_binlog.cc
+++ b/sql/wsrep_binlog.cc
@@ -509,7 +509,6 @@ void wsrep_dump_rbr_buf_with_header(THD *thd, const void *rbr_buf,
 
   if (init_io_cache(&cache, file, 0, WRITE_CACHE, 0, 0, MYF(MY_WME | MY_NABP)))
   {
-    mysql_file_close(file, MYF(MY_WME));
     goto cleanup2;
   }
 
diff --git a/storage/innobase/dict/dict0mem.cc b/storage/innobase/dict/dict0mem.cc
index d3333de5ced..f919fb7b9cf 100644
--- a/storage/innobase/dict/dict0mem.cc
+++ b/storage/innobase/dict/dict0mem.cc
@@ -480,7 +480,8 @@ dict_mem_table_col_rename_low(
 	ut_ad(to_len <= NAME_LEN);
 
 	char from[NAME_LEN + 1];
-	strncpy(from, s, NAME_LEN + 1);
+	strncpy(from, s, sizeof from - 1);
+	from[sizeof from - 1] = '\0';
 
 	if (from_len == to_len) {
 		/* The easy case: simply replace the column name in