--- /dev/null
+From: Alexey KopytovDate: April 18 2008 9:00am
+Subject: bk commit into 5.0 tree (kaa:1.2606) BUG#35298
+
+Below is the list of changes that have just been committed into a local
+5.0 repository of kaa. When kaa does a push these changes
+will be propagated to the main repository and, within 24 hours after the
+push, to the public repository.
+For information on how to access the public repository
+see http://dev.mysql.com/doc/mysql/en/installing-source-tree.html
+
+ChangeSet@stripped, 2008-04-18 11:00:51+04:00, kaa@kaamos.(none) +3 -0
+ Fix for bug #35298: GROUP_CONCAT with DISTINCT can crash the server
+
+ The bug is a regression introduced by the patch for bug32798.
+
+ The code in Item_func_group_concat::clear() relied on the 'distinct'
+ variable to check if 'unique_filter' was initialized. That, however,
+ is not always valid because Item_func_group_concat::setup() can do
+ shortcuts in some cases w/o initializing 'unique_filter'.
+
+ Fixed by checking the value of 'unique_filter' instead of 'distinct'
+ before dereferencing.
+
+ sql/item_sum.cc@stripped, 2008-04-18 11:00:50+04:00, kaa@kaamos.(none) +1 -1
+ Check if unique_filter != NULL before dereferencing it. Non-zero value
+ of distinct does not always mean that unique_filter is initialized
+ because Item_func_group_concat::setup() can do shortcuts is some cases
+
+diff -Nrup a/sql/item_sum.cc b/sql/item_sum.cc
+--- a/sql/item_sum.cc 2008-03-28 14:31:48 +03:00
++++ b/sql/item_sum.cc 2008-04-18 11:00:50 +04:00
+@@ -3222,7 +3222,7 @@ void Item_func_group_concat::clear()
+ no_appended= TRUE;
+ if (tree)
+ reset_tree(tree);
+- if (distinct)
++ if (unique_filter)
+ unique_filter->reset();
+ /* No need to reset the table as we never call write_row */
+ }