3 files changed, 24 insertions, 1 deletions
diff --git a/plugin/type_inet/mysql-test/type_inet/type_inet6.result b/plugin/type_inet/mysql-test/type_inet/type_inet6.result
index 5ac2657f..d43352df 100644
--- a/plugin/type_inet/mysql-test/type_inet/type_inet6.result
+++ b/plugin/type_inet/mysql-test/type_inet/type_inet6.result
@@ -2359,6 +2359,18 @@ Warning	1292	Incorrect inet6 value: ''
 Warning	1292	Incorrect inet6 value: ''
 DROP TABLE t1;
 #
+# MDEV-32458 ASAN unknown-crash in Inet6::ascii_to_fbt when casting character string to inet6
+#
+CREATE TABLE t1 (c CHAR(3));
+INSERT INTO t1 VALUES ('1:0'),('00:');
+SELECT * FROM t1 WHERE c>CAST('::1' AS INET6);
+c
+Warnings:
+Warning	1292	Incorrect inet6 value: '1:0'
+Warning	1292	Incorrect inet6 value: '00:'
+DROP TABLE t1;
+# End of 10.6 tests
+#
 # MDEV-22256 Assertion `length == pack_length()' failed in Field_timestamp_with_dec::sort_string
 #
 SET sql_mode='';
diff --git a/plugin/type_inet/mysql-test/type_inet/type_inet6.test b/plugin/type_inet/mysql-test/type_inet/type_inet6.test
index 0c56ecfe..cb3d226f 100644
--- a/plugin/type_inet/mysql-test/type_inet/type_inet6.test
+++ b/plugin/type_inet/mysql-test/type_inet/type_inet6.test
@@ -1702,6 +1702,17 @@ SELECT 1.00 + (b IN (a,'')) AS f FROM t1 ORDER BY f;
 DROP TABLE t1;
 
 --echo #
+--echo # MDEV-32458 ASAN unknown-crash in Inet6::ascii_to_fbt when casting character string to inet6
+--echo #
+
+CREATE TABLE t1 (c CHAR(3));
+INSERT INTO t1 VALUES ('1:0'),('00:');
+SELECT * FROM t1 WHERE c>CAST('::1' AS INET6);
+DROP TABLE t1;
+
+--echo # End of 10.6 tests
+
+--echo #
 --echo # MDEV-22256 Assertion `length == pack_length()' failed in Field_timestamp_with_dec::sort_string
 --echo #
 
diff --git a/plugin/type_inet/sql_type_inet.cc b/plugin/type_inet/sql_type_inet.cc
index 03c8d813..d23073d2 100644
--- a/plugin/type_inet/sql_type_inet.cc
+++ b/plugin/type_inet/sql_type_inet.cc
@@ -229,7 +229,7 @@ bool Inet6::ascii_to_fbt(const char *str, size_t str_length)
         continue;
       }
 
-      if (!*p || p >= str_end)
+      if (p >= str_end || !*p)
       {
         DBUG_PRINT("error", ("ascii_to_ipv6(%.*s): invalid IPv6 address: "
                              "ending at ':'.", (int) str_length, str));