The subst_spvars function is used to create query string with SP variables 
substituted with their values. This string is used later for the binary log
and for the query cache. The problem is that the
query_cache_send_result_to_client function requires some additional space
after the query to store database name and query cache flags. This 
space wasn't reserved by the subst_spvars function which led to a memory
corruption and crash.

Now the subst_spvars function reserves additional space for the query cache.


mysql-test/t/query_cache.test:
  Added a test case for the bug#29856: Insufficient buffer space led to a server crash.
mysql-test/r/query_cache.result:
  Added a test case for the bug#29856: Insufficient buffer space led to a server crash.
sql/sp_head.cc:
  Bug#29856: Insufficient buffer space led to a server crash.
  Now the subst_spvars function reserves additional space for the query cache.