19 files changed, 349 insertions, 5 deletions
diff --git a/mysql-test/mysql-test-run.pl b/mysql-test/mysql-test-run.pl
index 451b877f9a8..1954d2798ed 100755
--- a/mysql-test/mysql-test-run.pl
+++ b/mysql-test/mysql-test-run.pl
@@ -450,8 +450,9 @@ sub main {
   #
   read_plugin_defs("include/plugin.defs");
 
-  # Also read from any plugin local plugin.defs
-  for (glob "$basedir/plugin/*/tests/mtr/plugin.defs") {
+  # Also read from any plugin local or suite specific plugin.defs
+  for (glob "$basedir/plugin/*/tests/mtr/plugin.defs".
+            " suite/*/plugin.defs") {
     read_plugin_defs($_);
   }
 
diff --git a/mysql-test/r/ctype_errors.result b/mysql-test/r/ctype_errors.result
index d8218e40e6f..b3632454eb1 100644
--- a/mysql-test/r/ctype_errors.result
+++ b/mysql-test/r/ctype_errors.result
@@ -29,4 +29,14 @@ SET lc_messages=cs_CZ;
 SET NAMES UTF8;
 USE nonexistant;
 ERROR 42000: Nezn-Bámá databáze 'nonexistant'
-End of 5.4 tests
+#
+# Bug#12736295: Buffer overflow for variable converted_err
+#               with non-latin1 server error message
+#
+# Connection con1
+SET lc_messages=ru_RU;
+SET NAMES latin1;
+SELECT '01234567890123456789012345678901234\';
+ERROR 42000: \0423 \0432\0430\0441 \043E\0448\0438\0431\043A\0430 \0432 \0437\0430\043F\0440\043E\0441\0435. \0418\0437\0443\0447\0438\0442\0435 \0434\043E\043A\0443\043C\0435\043D\0442\0430\0446\0438\044E \043F\043E \0438\0441\043F\043E\043B\044C\0437\0443\0435\043C\043E\0439 \0432\0435\0440\0441\0438\0438 MySQL \043D\0430 \043F\0440\0435\0434\043C\0435\0442 \043A\043E\0440\0440\0435\043A\0442\043D\043E\0433\043E \0441\0438\043D\0442\0430\043A\0441\0438\0441\0430 \043E\043A\043E\043B\043E ''012345678901234567890123456
+# Connection default
+End of 5.5 tests
diff --git a/mysql-test/r/ctype_utf32_uca.result b/mysql-test/r/ctype_utf32_uca.result
index fd5a4199217..a9f056b2e44 100644
--- a/mysql-test/r/ctype_utf32_uca.result
+++ b/mysql-test/r/ctype_utf32_uca.result
@@ -2415,5 +2415,25 @@ HEX(s1)
 00000061
 DROP TABLE t1;
 #
+# Bug #12319710 : INVALID MEMORY READ AND/OR CRASH IN 
+#   MY_UCA_CHARCMP WITH UTF32
+#
+SET collation_connection=utf32_unicode_ci;
+CREATE TABLE t1 (a TEXT CHARACTER SET utf32 COLLATE utf32_turkish_ci NOT NULL);
+INSERT INTO t1 VALUES ('a'), ('b');
+CREATE TABLE t2 (b VARBINARY(5) NOT NULL);
+#insert chars outside of BMP
+INSERT INTO t2 VALUEs (0x082837),(0x082837);
+#test for read-out-of-bounds with non-BMP chars as a LIKE pattern
+SELECT * FROM t1,t2 WHERE a LIKE b;
+a	b
+#test the original statement
+SELECT 1 FROM t1 AS t1_0 NATURAL LEFT OUTER JOIN t2 AS t2_0
+RIGHT JOIN t1 AS t1_1 ON t1_0.a LIKE t2_0.b;
+1
+1
+1
+DROP TABLE t1,t2;
+#
 # End of 5.5 tests
 #
diff --git a/mysql-test/r/order_by.result b/mysql-test/r/order_by.result
index 1e65f889ea0..9ad8e940fe5 100644
--- a/mysql-test/r/order_by.result
+++ b/mysql-test/r/order_by.result
@@ -1665,6 +1665,13 @@ a	1
 3	1
 2	1
 DROP TABLE t1;
+#
+# Bug#11765255 58201:
+# VALGRIND/CRASH WHEN ORDERING BY MULTIPLE AGGREGATE FUNCTIONS
+#
+select 1 order by max(1) + min(1);
+1
+1
 End of 5.1 tests
 #
 # Bug #38745: MySQL 5.1 optimizer uses filesort for ORDER BY
diff --git a/mysql-test/r/plugin_auth.result b/mysql-test/r/plugin_auth.result
index 327ba2969e9..64bc870a7fa 100644
--- a/mysql-test/r/plugin_auth.result
+++ b/mysql-test/r/plugin_auth.result
@@ -44,7 +44,7 @@ ERROR 28000: Access denied for user 'plug'@'localhost' (using password: YES)
 ## test correct default plugin
 select USER(),CURRENT_USER();
 USER()	CURRENT_USER()
-plug@localhost	plug@%
+plug@localhost	plug_dest@%
 ## test no_auto_create_user sql mode with plugin users
 SET @@sql_mode=no_auto_create_user;
 GRANT INSERT ON TEST.* TO grant_user IDENTIFIED WITH 'test_plugin_server';
@@ -462,4 +462,24 @@ CREATE USER bug12610784@localhost;
 SET PASSWORD FOR bug12610784@localhost = PASSWORD('secret');
 ERROR 28000: Access denied for user 'bug12610784'@'localhost' (using password: NO)
 DROP USER bug12610784@localhost;
+#
+# Bug #12818542: PAM: ADDING PASSWORD FOR AN ACCOUNT DISABLES PAM 
+#   AUTHENTICATION SETTINGS
+#
+CREATE USER bug12818542@localhost 
+IDENTIFIED WITH 'test_plugin_server' AS 'bug12818542_dest';
+CREATE USER bug12818542_dest@localhost 
+IDENTIFIED BY 'bug12818542_dest_passwd';
+GRANT PROXY ON bug12818542_dest@localhost TO bug12818542@localhost;
+SELECT USER(),CURRENT_USER();
+USER()	CURRENT_USER()
+bug12818542@localhost	bug12818542_dest@localhost
+SET PASSWORD = PASSWORD('bruhaha');
+Warnings:
+Note	1699	SET PASSWORD has no significance for users authenticating via plugins
+SELECT USER(),CURRENT_USER();
+USER()	CURRENT_USER()
+bug12818542@localhost	bug12818542_dest@localhost
+DROP USER bug12818542@localhost;
+DROP USER bug12818542_dest@localhost;
 End of 5.5 tests
diff --git a/mysql-test/r/sp-error.result b/mysql-test/r/sp-error.result
index 4e97429c48f..0da4ed34e89 100644
--- a/mysql-test/r/sp-error.result
+++ b/mysql-test/r/sp-error.result
@@ -1717,6 +1717,22 @@ ERROR HY000: View 'test.v1' references invalid table(s) or column(s) or function
 DROP PROCEDURE p1;
 DROP VIEW v1;
 DROP TABLE t1;
+#
+# Bug#12428824 - PARSER STACK OVERFLOW AND CRASH IN SP_ADD_USED_ROUTINE
+#                WITH OBSCURE QUERY
+#
+SELECT very_long_fn_name_1111111111111111111111111111111111111111111111111111111111111111111111111222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222225555555555555555555555555577777777777777777777777777777777777777777777777777777777777777777777777788888888999999999999999999999();
+ERROR 42000: Identifier name 'very_long_fn_name_1111111111111111111111111111111111111111111111111111111111111111111111111222222222' is too long
+CALL very_long_pr_name_1111111111111111111111111111111111111111111111111111111111111111111111111222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222225555555555555555555555555577777777777777777777777777777777777777777777777777777777777777777777777788888888999999999999999999999();
+ERROR 42000: Identifier name 'very_long_pr_name_1111111111111111111111111111111111111111111111111111111111111111111111111222222222' is too long
+SELECT very_long_db_name_1111111111111111111111111111111111111111111111111111111111111111111111111222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222225555555555555555555555555577777777777777777777777777777777777777777777777777777777777777777777777788888888999999999999999999999.simple_func();
+ERROR 42000: Incorrect database name 'very_long_db_name_1111111111111111111111111111111111111111111111111111111111111111111111111222222222'
+CALL very_long_db_name_1111111111111111111111111111111111111111111111111111111111111111111111111222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222225555555555555555555555555577777777777777777777777777777777777777777777777777777777777777777777777788888888999999999999999999999.simple_proc();
+ERROR 42000: Incorrect database name 'very_long_db_name_1111111111111111111111111111111111111111111111111111111111111111111111111222222222'
+SELECT db_name.very_long_fn_name_111111111111111111111111111111111111111111111111111111111111111111111111122222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222999999999999999999999();
+ERROR 42000: Identifier name 'very_long_fn_name_1111111111111111111111111111111111111111111111111111111111111111111111111222222222' is too long
+CALL db_name.very_long_pr_name_111111111111111111111111111111111111111111111111111111111111111111111111122222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222999999999999999999999();
+ERROR 42000: Identifier name 'very_long_pr_name_1111111111111111111111111111111111111111111111111111111111111111111111111222222222' is too long
 End of 5.1 tests
 #
 # Bug#23032: Handlers declared in a SP do not handle warnings generated in sub-SP
diff --git a/mysql-test/r/sp.result b/mysql-test/r/sp.result
index a8428476e34..104ddd3353b 100644
--- a/mysql-test/r/sp.result
+++ b/mysql-test/r/sp.result
@@ -7162,6 +7162,21 @@ SET @@GLOBAL.init_connect= @old_init_connect;
 DROP PROCEDURE p2;
 DROP PROCEDURE p5;
 #
+# Bug#11840395 (formerly known as bug#60347):
+# The string "versiondata" seems
+# to be 'leaking' into the schema name space
+#
+DROP DATABASE IF EXISTS mixedCaseDbName;
+CREATE DATABASE mixedCaseDbName;
+CREATE PROCEDURE mixedCaseDbName.tryMyProc() begin end|
+CREATE FUNCTION mixedCaseDbName.tryMyFunc() returns text begin return 'IT WORKS'; end
+|
+call mixedCaseDbName.tryMyProc();
+select mixedCaseDbName.tryMyFunc();
+mixedCaseDbName.tryMyFunc()
+IT WORKS
+DROP DATABASE mixedCaseDbName;
+#
 # Bug#11766594  59736: SELECT DISTINCT.. INCORRECT RESULT WITH DETERMINISTIC FUNCTION IN WHERE C
 #
 CREATE TABLE t1 (a INT, b INT, KEY(b));
diff --git a/mysql-test/r/type_float.result b/mysql-test/r/type_float.result
index 546e281ee67..211898e366f 100644
--- a/mysql-test/r/type_float.result
+++ b/mysql-test/r/type_float.result
@@ -431,4 +431,19 @@ SELECT f1 FROM t1;
 f1
 -1.79769313486231e308
 DROP TABLE t1;
+#
+# Bug#12406055 BUFFER OVERFLOW OF VARIABLE 'BUFF' IN STRING::SET_REAL
+# 
+# Ignoring output from misc. float operations
+select format(-1.7976931348623157E+307,256) as foo;
+select least(-1.1111111111111111111111111,
+- group_concat(1.7976931348623157E+308)) as foo;
+select concat((truncate((-1.7976931348623157E+307),(0x1e))),
+(99999999999999999999999999999999999999999999999999999999999999999)) into @a;
 End of 5.0 tests
+#
+# Bug#12368853 FORMAT() CRASHES WITH LARGE NUMBERS AFTER TRUNCATE...
+#
+select format(truncate('1.7976931348623157E+308',-12),1,'fr_BE') as foo;
+foo
+0
diff --git a/mysql-test/r/union.result b/mysql-test/r/union.result
index 1f3422c1767..0fd1526684a 100644
--- a/mysql-test/r/union.result
+++ b/mysql-test/r/union.result
@@ -1643,6 +1643,63 @@ b
 1
 2
 DROP TABLE t1,t2;
+#
+# Bug#11765255 58201:
+# VALGRIND/CRASH WHEN ORDERING BY MULTIPLE AGGREGATE FUNCTIONS
+#
+select 1 as foo
+union
+select 2
+union
+select 3
+union
+select 4
+order by max(42) + max(1) + max(1) + max(1) + max(1) + max(1)
+;
+foo
+1
+prepare stmt1 from 'select 1 as foo
+union
+select 2
+union
+select 3
+union
+select 4
+order by max(42) + max(1) + max(1) + max(1) + max(1) + max(1)
+';
+execute stmt1;
+foo
+1
+execute stmt1;
+foo
+1
+select 1 as foo
+union
+select 2
+union
+select 3
+union
+(select 4)
+order by max(42) + max(1) + max(1) + max(1) + max(1) + max(1)
+;
+foo
+1
+prepare stmt1 from 'select 1 as foo
+union
+select 2
+union
+select 3
+union
+(select 4)
+order by max(42) + max(1) + max(1) + max(1) + max(1) + max(1)
+';
+execute stmt1;
+foo
+1
+execute stmt1;
+foo
+1
+deallocate prepare stmt1;
 End of 5.1 tests
 #
 # Bug#57986 ORDER BY clause is not used after a UNION, 
diff --git a/mysql-test/suite/sys_vars/r/all_vars.result b/mysql-test/suite/sys_vars/r/all_vars.result
index af05e3bc393..715ad9e2c15 100644
--- a/mysql-test/suite/sys_vars/r/all_vars.result
+++ b/mysql-test/suite/sys_vars/r/all_vars.result
@@ -11,5 +11,7 @@ There should be *no* long test name listed below:
 select variable_name as `There should be *no* variables listed below:` from t2
 left join t1 on variable_name=test_name where test_name is null;
 There should be *no* variables listed below:
+INNODB_LARGE_PREFIX
+INNODB_LARGE_PREFIX
 drop table t1;
 drop table t2;
diff --git a/mysql-test/t/ctype_errors.test b/mysql-test/t/ctype_errors.test
index 3c73fdae264..681223dae64 100644
--- a/mysql-test/t/ctype_errors.test
+++ b/mysql-test/t/ctype_errors.test
@@ -44,4 +44,19 @@ USE nonexistant;
 disconnect con1;
 connection default;
 
---echo End of 5.4 tests
+--echo #
+--echo # Bug#12736295: Buffer overflow for variable converted_err
+--echo #               with non-latin1 server error message
+--echo #
+
+connect (con1,localhost,root,,test);
+--echo # Connection con1
+SET lc_messages=ru_RU;
+SET NAMES latin1;
+--error ER_PARSE_ERROR
+--query SELECT '01234567890123456789012345678901234\'
+disconnect con1;
+--echo # Connection default
+connection default;
+
+--echo End of 5.5 tests
diff --git a/mysql-test/t/ctype_utf32_uca.test b/mysql-test/t/ctype_utf32_uca.test
index a62ffbf95c7..1d79fbe1616 100644
--- a/mysql-test/t/ctype_utf32_uca.test
+++ b/mysql-test/t/ctype_utf32_uca.test
@@ -293,6 +293,27 @@ SET collation_connection=utf32_czech_ci;
 --source include/ctype_czech.inc
 --source include/ctype_like_ignorable.inc
 
+--echo #
+--echo # Bug #12319710 : INVALID MEMORY READ AND/OR CRASH IN 
+--echo #   MY_UCA_CHARCMP WITH UTF32
+--echo #
+
+SET collation_connection=utf32_unicode_ci;
+CREATE TABLE t1 (a TEXT CHARACTER SET utf32 COLLATE utf32_turkish_ci NOT NULL);
+INSERT INTO t1 VALUES ('a'), ('b');
+CREATE TABLE t2 (b VARBINARY(5) NOT NULL);
+
+--echo #insert chars outside of BMP
+INSERT INTO t2 VALUEs (0x082837),(0x082837);
+
+--echo #test for read-out-of-bounds with non-BMP chars as a LIKE pattern
+SELECT * FROM t1,t2 WHERE a LIKE b;
+
+--echo #test the original statement
+SELECT 1 FROM t1 AS t1_0 NATURAL LEFT OUTER JOIN t2 AS t2_0
+RIGHT JOIN t1 AS t1_1 ON t1_0.a LIKE t2_0.b;
+
+DROP TABLE t1,t2;
 
 --echo #
 --echo # End of 5.5 tests
diff --git a/mysql-test/t/mysql_plugin.test b/mysql-test/t/mysql_plugin.test
index b07ce40e43a..09615ec8f00 100644
--- a/mysql-test/t/mysql_plugin.test
+++ b/mysql-test/t/mysql_plugin.test
@@ -224,6 +224,7 @@ let $MYSQL_PLUGIN_CMD= $MYSQL_PLUGIN -n --datadir=/data_not_there/ --basedir=$MY
 --echo # Attempt to use bad paths - basedir
 --echo #
 let $MYSQL_PLUGIN_CMD= $MYSQL_PLUGIN -n --datadir=$MYSQLD_DATADIR --basedir=/basedir_not_there/ --plugin-dir=$PLUGIN_DIR --mysqld=$MYSQLD_BASEDIR --my-print-defaults=$MYSQL_MY_PRINT_DEFAULTS_BASEDIR;
+replace_result "/basedir_not_there//" "/basedir_not_there/";
 --error 1,2,256
 --exec $MYSQL_PLUGIN_CMD DISABLE daemon_example 2>&1
 
diff --git a/mysql-test/t/order_by.test b/mysql-test/t/order_by.test
index 726dfa154b8..81e5d4fca70 100644
--- a/mysql-test/t/order_by.test
+++ b/mysql-test/t/order_by.test
@@ -1509,6 +1509,13 @@ SELECT DISTINCT a,1 FROM t1 WHERE a <> 1 ORDER BY a DESC;
 
 DROP TABLE t1;
 
+--echo #
+--echo # Bug#11765255 58201:
+--echo # VALGRIND/CRASH WHEN ORDERING BY MULTIPLE AGGREGATE FUNCTIONS
+--echo #
+
+select 1 order by max(1) + min(1);
+
 --echo End of 5.1 tests
 
 
diff --git a/mysql-test/t/plugin_auth.test b/mysql-test/t/plugin_auth.test
index 0dc3068de61..f169360cf2e 100644
--- a/mysql-test/t/plugin_auth.test
+++ b/mysql-test/t/plugin_auth.test
@@ -540,4 +540,35 @@ connection default;
 disconnect b12610784;
 DROP USER bug12610784@localhost;
 
+
+--echo #
+--echo # Bug #12818542: PAM: ADDING PASSWORD FOR AN ACCOUNT DISABLES PAM 
+--echo #   AUTHENTICATION SETTINGS
+--echo #
+
+CREATE USER bug12818542@localhost 
+  IDENTIFIED WITH 'test_plugin_server' AS 'bug12818542_dest';
+CREATE USER bug12818542_dest@localhost 
+  IDENTIFIED BY 'bug12818542_dest_passwd';
+GRANT PROXY ON bug12818542_dest@localhost TO bug12818542@localhost;
+
+connect(bug12818542_con,localhost,bug12818542,bug12818542_dest);
+connection bug12818542_con;
+SELECT USER(),CURRENT_USER();
+
+SET PASSWORD = PASSWORD('bruhaha');
+
+connection default;
+disconnect bug12818542_con;
+
+connect(bug12818542_con2,localhost,bug12818542,bug12818542_dest);
+connection bug12818542_con2;
+SELECT USER(),CURRENT_USER();
+
+connection default;
+disconnect bug12818542_con2;
+
+DROP USER bug12818542@localhost;
+DROP USER bug12818542_dest@localhost;
+
 --echo End of 5.5 tests
diff --git a/mysql-test/t/sp-error.test b/mysql-test/t/sp-error.test
index 6175fc53adf..063b30c01cb 100644
--- a/mysql-test/t/sp-error.test
+++ b/mysql-test/t/sp-error.test
@@ -2541,6 +2541,28 @@ DROP PROCEDURE p1;
 DROP VIEW v1;
 DROP TABLE t1;
 
+--echo #
+--echo # Bug#12428824 - PARSER STACK OVERFLOW AND CRASH IN SP_ADD_USED_ROUTINE
+--echo #                WITH OBSCURE QUERY
+--echo #
+
+--error ER_TOO_LONG_IDENT
+SELECT very_long_fn_name_1111111111111111111111111111111111111111111111111111111111111111111111111222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222225555555555555555555555555577777777777777777777777777777777777777777777777777777777777777777777777788888888999999999999999999999();
+
+--error ER_TOO_LONG_IDENT
+CALL very_long_pr_name_1111111111111111111111111111111111111111111111111111111111111111111111111222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222225555555555555555555555555577777777777777777777777777777777777777777777777777777777777777777777777788888888999999999999999999999();
+
+--error ER_WRONG_DB_NAME
+SELECT very_long_db_name_1111111111111111111111111111111111111111111111111111111111111111111111111222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222225555555555555555555555555577777777777777777777777777777777777777777777777777777777777777777777777788888888999999999999999999999.simple_func();
+
+--error ER_WRONG_DB_NAME
+CALL very_long_db_name_1111111111111111111111111111111111111111111111111111111111111111111111111222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222225555555555555555555555555577777777777777777777777777777777777777777777777777777777777777777777777788888888999999999999999999999.simple_proc();
+
+--error ER_TOO_LONG_IDENT
+SELECT db_name.very_long_fn_name_111111111111111111111111111111111111111111111111111111111111111111111111122222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222999999999999999999999();
+
+--error ER_TOO_LONG_IDENT
+CALL db_name.very_long_pr_name_111111111111111111111111111111111111111111111111111111111111111111111111122222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222999999999999999999999();
 --echo End of 5.1 tests
 
 --echo #
diff --git a/mysql-test/t/sp.test b/mysql-test/t/sp.test
index 5586231ea62..07b8c065be4 100644
--- a/mysql-test/t/sp.test
+++ b/mysql-test/t/sp.test
@@ -8376,6 +8376,26 @@ SET @@GLOBAL.init_connect= @old_init_connect;
 DROP PROCEDURE p2;
 DROP PROCEDURE p5;
 
+
+--echo #
+--echo # Bug#11840395 (formerly known as bug#60347):
+--echo # The string "versiondata" seems
+--echo # to be 'leaking' into the schema name space
+--echo #
+--disable_warnings
+DROP DATABASE IF EXISTS mixedCaseDbName;
+--enable_warnings
+CREATE DATABASE mixedCaseDbName;
+DELIMITER |;
+CREATE PROCEDURE mixedCaseDbName.tryMyProc() begin end|
+CREATE FUNCTION mixedCaseDbName.tryMyFunc() returns text begin return 'IT WORKS'; end
+|
+DELIMITER ;|
+call mixedCaseDbName.tryMyProc();
+select mixedCaseDbName.tryMyFunc();
+DROP DATABASE mixedCaseDbName;
+
+
 --echo #
 --echo # Bug#11766594  59736: SELECT DISTINCT.. INCORRECT RESULT WITH DETERMINISTIC FUNCTION IN WHERE C
 --echo #
diff --git a/mysql-test/t/type_float.test b/mysql-test/t/type_float.test
index 45cf80aab5c..b33c51566a0 100644
--- a/mysql-test/t/type_float.test
+++ b/mysql-test/t/type_float.test
@@ -307,4 +307,27 @@ INSERT INTO t1 VALUES(-1.79769313486231e+308);
 SELECT f1 FROM t1;
 DROP TABLE t1;
 
+--echo #
+--echo # Bug#12406055 BUFFER OVERFLOW OF VARIABLE 'BUFF' IN STRING::SET_REAL
+--echo # 
+
+--echo # Ignoring output from misc. float operations
+--disable_result_log
+
+let $nine_65=
+99999999999999999999999999999999999999999999999999999999999999999;
+
+select format(-1.7976931348623157E+307,256) as foo;
+select least(-1.1111111111111111111111111,
+             - group_concat(1.7976931348623157E+308)) as foo;
+eval select concat((truncate((-1.7976931348623157E+307),(0x1e))),
+                   ($nine_65)) into @a;
+--enable_result_log
+
 --echo End of 5.0 tests
+
+--echo #
+--echo # Bug#12368853 FORMAT() CRASHES WITH LARGE NUMBERS AFTER TRUNCATE...
+--echo #
+
+select format(truncate('1.7976931348623157E+308',-12),1,'fr_BE') as foo;
diff --git a/mysql-test/t/union.test b/mysql-test/t/union.test
index c6599517e90..f5a5cad77e8 100644
--- a/mysql-test/t/union.test
+++ b/mysql-test/t/union.test
@@ -1116,6 +1116,47 @@ SELECT * FROM t2 UNION SELECT * FROM t2
 DROP TABLE t1,t2;
 
 
+--echo #
+--echo # Bug#11765255 58201:
+--echo # VALGRIND/CRASH WHEN ORDERING BY MULTIPLE AGGREGATE FUNCTIONS
+--echo #
+
+let $my_stmt=
+select 1 as foo
+union
+select 2
+union
+select 3
+union
+select 4
+order by max(42) + max(1) + max(1) + max(1) + max(1) + max(1)
+;
+
+eval $my_stmt;
+
+eval prepare stmt1 from '$my_stmt';
+execute stmt1;
+execute stmt1;
+
+let $my_stmt=
+select 1 as foo
+union
+select 2
+union
+select 3
+union
+(select 4)
+order by max(42) + max(1) + max(1) + max(1) + max(1) + max(1)
+;
+
+eval $my_stmt;
+
+eval prepare stmt1 from '$my_stmt';
+execute stmt1;
+execute stmt1;
+
+deallocate prepare stmt1;
+
 --echo End of 5.1 tests
 
 --echo #