Fixed core dump bug in ORDER BY ... LIMIT

Docs/manual.texi

@@ -46929,6 +46929,8 @@ not yet 100% confident in this code.
 @appendixsubsec Changes in release 3.23.53
 @itemize @bullet
 @item
+Fixed unlikely core dump with @code{SELECT ... ORDER BY ... LIMIT}.
+@item
 Changed @code{AND/OR} to report that they can return NULL. This fixes a
 bug in @code{GROUP BY} on @code{AND/OR} expression that return
 @code{NULL}.

sql/filesort.cc

@@ -378,13 +378,18 @@ static ha_rows find_all_keys(SORTPARAM *param, SQL_SELECT *select,
 	if (indexpos >= *maxbuffer ||
 	    write_keys(param,sort_keys,idx,buffpek+indexpos,tempfile))
 	      DBUG_RETURN(HA_POS_ERROR);
-	idx=0; indexpos++;
+	idx=0;
 	if (param->ref_length == param->sort_length &&
 	    my_b_tell(tempfile)/param->sort_length >= param->max_rows)
 	{
+	  /*
+	    We are writing the result index file and have found all
+	    rows that we need.  Abort the sort and return the result.
+	  */
 	  error=HA_ERR_END_OF_FILE;
 	  break;			/* Found enough records */
 	}
+	indexpos++;
       }
       make_sortkey(param,sort_keys[idx++],ref_pos);
     }
@@ -399,7 +404,7 @@ static ha_rows find_all_keys(SORTPARAM *param, SQL_SELECT *select,
     file->print_error(error,MYF(ME_ERROR | ME_WAITTANG)); /* purecov: inspected */
     DBUG_RETURN(HA_POS_ERROR);			/* purecov: inspected */
   }
-  if (indexpos)
+  if (indexpos && idx)
     if (indexpos >= *maxbuffer ||
 	write_keys(param,sort_keys,idx,buffpek+indexpos,tempfile))
       DBUG_RETURN(HA_POS_ERROR);		/* purecov: inspected */