From a3f4db4b7d86effa3e0d3facf3f1e55713f1701c Mon Sep 17 00:00:00 2001
From: Ti Chi Robot <ti-community-prow-bot@tidb.io>
Date: Tue, 18 Jan 2022 14:59:44 +0800
Subject: [PATCH] fix lpad/rpad coredump because of trailing zero (#3881)
 (#3883)

---
 dbms/src/Functions/FunctionsString.cpp | 28 +++++++++++++-------------
 tests/fullstack-test/expr/pad.test     |  8 ++++++++
 2 files changed, 22 insertions(+), 14 deletions(-)

diff --git a/dbms/src/Functions/FunctionsString.cpp b/dbms/src/Functions/FunctionsString.cpp
index f1d32f75d4e..7c6709c444b 100644
--- a/dbms/src/Functions/FunctionsString.cpp
+++ b/dbms/src/Functions/FunctionsString.cpp
@@ -2989,9 +2989,9 @@ class tidbPadImpl
                     per_pad_offset = (per_pad_offset + pad_bytes) % (padding_size - 1);
                     --left;
                 }
-                // Including the tailing '\0'.
-                copyResult(res, res_offset, data, 0, data_size);
-                res_offset += data_size;
+                // The tailing '\0' will be handled later.
+                copyResult(res, res_offset, data, 0, data_size - 1);
+                res_offset += data_size - 1;
             }
             else
             {
@@ -3006,8 +3006,6 @@ class tidbPadImpl
                     per_pad_offset = (per_pad_offset + pad_bytes) % (padding_size - 1);
                     --left;
                 }
-                res[res_offset] = '\0';
-                res_offset++;
             }
         }
         else
@@ -3021,9 +3019,11 @@ class tidbPadImpl
                 per_pad_offset += pad_bytes;
                 ++left;
             }
-            res[res_offset] = '\0';
-            res_offset++;
         }
+        // Add trailing zero.
+        res.resize(res.size() + 1);
+        res[res_offset] = '\0';
+        res_offset++;
         return false;
     }
 
@@ -3059,9 +3059,9 @@ class tidbPadImpl
                     ++res_offset;
                     --left;
                 }
-                // Including the tailing '\0'.
-                copyResult(res, res_offset, data, 0, data_size);
-                res_offset += data_size;
+                // The tailing '\0' will be handled later.
+                copyResult(res, res_offset, data, 0, data_size - 1);
+                res_offset += data_size - 1;
             }
             else
             {
@@ -3081,17 +3081,17 @@ class tidbPadImpl
                     ++res_offset;
                     --left;
                 }
-                res[res_offset] = '\0';
-                res_offset++;
             }
         }
         else
         {
             copyResult(res, res_offset, data, 0, tmp_target_len);
             res_offset += tmp_target_len;
-            res[res_offset] = '\0';
-            res_offset++;
         }
+        // Add trailing zero.
+        res.resize(res.size() + 1);
+        res[res_offset] = '\0';
+        res_offset++;
         return false;
     }
 
diff --git a/tests/fullstack-test/expr/pad.test b/tests/fullstack-test/expr/pad.test
index e71f8fd853d..2e11cb76c49 100644
--- a/tests/fullstack-test/expr/pad.test
+++ b/tests/fullstack-test/expr/pad.test
@@ -14,8 +14,13 @@ mysql> insert into test.t1 values(5, '杭州', '西湖')
 mysql> insert into test.t1 values(5, '杭州', 'test')
 mysql> insert into test.t1 values(5, '', '西湖')
 mysql> alter table test.t1 set tiflash replica 1
+mysql> drop table if exists test.t2
+mysql> create table test.t2(c1 varchar(100))
+mysql> insert into test.t2 values('b')
+mysql> alter table test.t2 set tiflash replica 1
 func> wait_table test t
 func> wait_table test t1
+func> wait_table test t2
 
 mysql> set tidb_isolation_read_engines='tiflash'; set tidb_enforce_mpp=1; select lpad(c2, c1, c3) from test.t
 +------------------+
@@ -89,3 +94,6 @@ mysql> set tidb_isolation_read_engines='tiflash'; set tidb_enforce_mpp=1; select
 +----------------+----------+
 |                |        5 |
 +----------------+----------+
+
+mysql> set tidb_isolation_read_engines='tiflash'; set tidb_enforce_mpp=1; SELECT max(lpad('y',0,c1)) FROM test.t2
+max(lpad('y',0,c1))