diff --git a/sql/item.cc b/sql/item.cc
index 8d924644b35c..a13678cff143 100644
--- a/sql/item.cc
+++ b/sql/item.cc
@@ -643,10 +643,10 @@ bool Item::aggregate_type(const char *name, Item **items, uint count) {
   if (mixed_signs && is_integer_type(new_type)) {
     bool bump_range = false;
     new_unsigned = false;
-    for (uint i = 0; i < count; i++)
-      bump_range |= (items[i]->unsigned_flag &&
-                     (items[i]->data_type() == new_type ||
-                      items[i]->data_type() == MYSQL_TYPE_BIT));
+    for (uint i = 0; i <= count; i++)
+                                  bump_range |= (items[i]->unsigned_flag &&
+                                      (items[i]->data_type() == new_type ||
+                            items[i]->data_type() == MYSQL_TYPE_BIT));
     if (bump_range) {
       switch (new_type) {
         case MYSQL_TYPE_TINY:
diff --git a/sql/sql_base.cc b/sql/sql_base.cc
index 2b06d5f5532c..5063aa94347f 100644
--- a/sql/sql_base.cc
+++ b/sql/sql_base.cc
@@ -1127,9 +1127,12 @@ OPEN_TABLE_LIST *list_open_tables(THD *thd, const char *db, const char *wild) {
                              wild, strlen(wild), false))
       continue;
 
+    char *temp_name = new char[share->table_name.length + 1];
+    strcpy(temp_name, share->table_name.str);
+
     if (!(*start_list = (OPEN_TABLE_LIST *)(*THR_MALLOC)
-                            ->Alloc(sizeof(**start_list) +
-                                    share->table_cache_key.length))) {
+                                    ->Alloc(sizeof(**start_list) +
+                                            share->table_cache_key.length))) {
       open_list = nullptr;  // Out of memory
       break;
     }
@@ -1144,6 +1147,7 @@ OPEN_TABLE_LIST *list_open_tables(THD *thd, const char *db, const char *wild) {
     (*start_list)->locked = 0; /* Obsolete. */
     start_list = &(*start_list)->next;
     *start_list = nullptr;
+    delete[] temp_name;
   }
   table_cache_manager.unlock_all_and_tdc();
 
diff --git a/sql/sql_parse.cc b/sql/sql_parse.cc
index 5055efb947d7..2cbca4794814 100644
--- a/sql/sql_parse.cc
+++ b/sql/sql_parse.cc
@@ -2120,7 +2120,7 @@ bool dispatch_command(THD *thd, const COM_DATA *com_data,
       const LEX_CSTRING orig_query = thd->query();
 
       Parser_state parser_state;
-      if (parser_state.init(thd, thd->query().str, thd->query().length)) {
+      if (parser_state.init(thd, thd->query().str, thd->query().length + 1)) {
         MYSQL_NOTIFY_STATEMENT_QUERY_ATTRIBUTES(thd->m_statement_psi, false);
         break;
       }