fixed memory overrun (bug 380)

mysql-test/r/func_group.result:
  new tests
mysql-test/t/func_group.test:
  new tests
sql/item.cc:
  count items in select list
sql/item_subselect.cc:
  use number of item in select list for array creation
sql/item_sum.cc:
  with_sum_func now is boolean
sql/sql_derived.cc:
  use number of item in select list for array creation
sql/sql_lex.cc:
  create_refs changed with parsing_place enum variable
sql/sql_lex.h:
  added items in select list counter
  create_refs changed with parsing_place enum variable
  with_sum_func now is boolean
sql/sql_select.cc:
  use number of item in select list for array creation
sql/sql_union.cc:
  use number of item in select list for array creation
sql/sql_yacc.yy:
  create_refs changed with parsing_place enum variable

1 files changed, 10 insertions, 3 deletions

diff --git a/sql/sql_lex.h b/sql/sql_lex.h
index f31b3305e07..b4444c03280 100644
--- a/sql/sql_lex.h
+++ b/sql/sql_lex.h
@@ -77,7 +77,6 @@ enum enum_sql_command {
   SQLCOM_END
 };
 
-
 typedef List<Item> List_item;
 
 typedef struct st_lex_master_info
@@ -191,6 +190,13 @@ protected:
     *master, *slave,                  /* vertical links */
     *link_next, **link_prev;          /* list of whole SELECT_LEX */
 public:
+  enum enum_parsing_place
+  {
+    NO_MATTER,
+    IN_HAVING,
+    SELECT_LIST
+  };
+
   ulong options;
   enum sub_select_type linkage;
   SQL_LIST order_list;                /* ORDER clause */
@@ -200,8 +206,9 @@ public:
   // Arrays of pointers to top elements of all_fields list
   Item **ref_pointer_array;
 
-  uint with_sum_func;   /* sum function indicator and number of it */
-  bool create_refs;
+  uint select_items;    /* number of items in select_list */
+  enum_parsing_place parsing_place; /* where we are parsing expression */
+  bool with_sum_func;   /* sum function indicator */
   bool dependent;	/* dependent from outer select subselect */
   bool uncacheable;     /* result of this query can't be cached */
   bool no_table_names_allowed; /* used for global order by */