Crash in Gcalc_scan_iterator::point::get_shape with ST_DISTANCE and MULTILINESTRING in maria-5.3-gis

[Philip Stoev]

backtrace:

#4 <signal handler called>
#5 0x0825f2d0 in Gcalc_scan_iterator::point::get_shape (this=0x0) at gcalc_slicescan.h:283
#6 0x0825ebc2 in Item_func_distance::val_real (this=0xae6136f8) at item_geofunc.cc:1832
#7 0x081dbda7 in Item::send (this=0xae6136f8, protocol=0xa6d9c0c, buffer=0xae7fe060) at item.cc:5960
#8 0x082894bc in select_send::send_data (this=0xae613a18, items=...) at sql_class.cc:1919
#9 0x0832630c in JOIN::exec (this=0xae621390) at sql_select.cc:2069
#10 0x08328d28 in mysql_select (thd=0xa6d98e0, rref_pointer_array=0xa6db3f8, tables=0x0, wild_num=0, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0,
    having=0x0, proc_param=0x0, select_options=2147764736, result=0xae613a18, unit=0xa6daffc, select_lex=0xa6db2d8) at sql_select.cc:2885
#11 0x08320bf3 in handle_select (thd=0xa6d98e0, lex=0xa6dafa0, result=0xae613a18, setup_tables_done_option=0) at sql_select.cc:283
#12 0x082bc323 in execute_sqlcom_select (thd=0xa6d98e0, all_tables=0x0) at sql_parse.cc:5082
#13 0x082b3127 in mysql_execute_command (thd=0xa6d98e0) at sql_parse.cc:2227
#14 0x082be95f in mysql_parse (thd=0xa6d98e0,
    rawbuf=0xae612eb0 "SELECT ST_DISTANCE (\nPOINTFROMTEXT( ' POINT( 7 1 ) ' ) ,\nMULTILINESTRINGFROMTEXT( ' MULTILINESTRING(\n\t\t( 4 7 , 9 7 , 6 1 , 3 4 , 1 1 ) ,\n\t\t(3 5, 2 5, 2 4, 3 4, 3 5) )\n\t' )\n)", length=176, found_semicolon=0xae7ff228) at sql_parse.cc:6083
#15 0x082b0dc3 in dispatch_command (command=COM_QUERY, thd=0xa6d98e0, packet=0xa7343e9 "", packet_length=176) at sql_parse.cc:1206
#16 0x082b0249 in do_command (thd=0xa6d98e0) at sql_parse.cc:904
#17 0x082ad2c4 in handle_one_connection (arg=0xa6d98e0) at sql_connect.cc:1177
#18 0x00821919 in start_thread () from /lib/libpthread.so.0
#19 0x0076acce in clone () from /lib/libc.so.6

test case:

SELECT ST_DISTANCE (
        POINTFROMTEXT( ' POINT( 7 1 ) ' ) ,
        MULTILINESTRINGFROMTEXT( ' MULTILINESTRING(
                ( 4 7 , 9 7 , 6 1 , 3 4 , 1 1 ) ,
                (3 5, 2 5, 2 4, 3 4, 3 5) )
        ' )
);