MDEV-4286 Server crashes in Protocol_text::store, stack smashing detected

AVG() returns a double, its max_length is reasonably
limited by a double number length, even if the argument
is many Kbytes long.

mysql-test/r/func_group.result

@@ -2090,3 +2090,10 @@ set @@optimizer_switch=@save_optimizer_switch;
 # Cleanup for BUG#46680
 #
 DROP TABLE IF EXISTS t1,t2,t3,empty1;
+create table t1 (i int, d date);
+insert into t1 values (1, '2008-10-02'), (2, '2010-12-12');
+select avg(export_set( 3, 'y', sha(i))), group_concat(d) from t1 group by d order by i;
+avg(export_set( 3, 'y', sha(i)))	group_concat(d)
+0	2008-10-02
+0	2010-12-12
+drop table t1;

mysql-test/t/func_group.test

@@ -1372,3 +1372,11 @@ set @@optimizer_switch=@save_optimizer_switch;
 --echo #
 DROP TABLE IF EXISTS t1,t2,t3,empty1;
 
+#
+# MDEV-4286 Server crashes in Protocol_text::store, stack smashing detected
+#
+create table t1 (i int, d date);
+insert into t1 values (1, '2008-10-02'), (2, '2010-12-12');
+select avg(export_set( 3, 'y', sha(i))), group_concat(d) from t1 group by d order by i;
+drop table t1;
+

sql/item_sum.cc

@@ -1242,9 +1242,10 @@ void Item_sum_avg::fix_length_and_dec()
     f_scale=  args[0]->decimals;
     dec_bin_size= my_decimal_get_binary_size(f_precision, f_scale);
   }
-  else {
+  else
+  {
     decimals= min(args[0]->decimals + prec_increment, NOT_FIXED_DEC);
-    max_length= args[0]->max_length + prec_increment;
+    max_length= min(args[0]->max_length + prec_increment, float_length(decimals));
   }
 }