Skip to content

Commit 5d8020d

Browse files
sanja-byelkinsanja-byelkin
committed
Merge branch 'bb-11.4-release' into bb-11.8-release
2 parents 47f2278 + 7582e48 commit 5d8020d

6 files changed

Lines changed: 42 additions & 18 deletions

File tree

‎mysql-test/main/func_json.result‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1789,6 +1789,12 @@ null<=>json_extract('1',json_object(null,'{ }',null,null),'{}')
17891789
Warnings:
17901790
Warning 4042 Syntax error in JSON path in argument 2 to function 'json_extract' at position 1
17911791
#
1792+
# MDEV-39213: json range syntax crash
1793+
#
1794+
SELECT JSON_EXISTS(CONCAT('[', REPEAT('[', 4000), 'Y', REPEAT(']', 4000), ', 1]'), '$[100]');
1795+
JSON_EXISTS(CONCAT('[', REPEAT('[', 4000), 'Y', REPEAT(']', 4000), ', 1]'), '$[100]')
1796+
NULL
1797+
#
17921798
# MDEV-35548 UBSAN: runtime error: index -1 out of bounds for type 'json_path_step_t[32]'
17931799
# (aka 'struct st_json_path_step_t[32]')
17941800
#

‎mysql-test/main/func_json.test‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1226,6 +1226,12 @@ FROM JSON_TABLE (@data, '$[*]' COLUMNS (data text PATH '$.Data')) AS t;
12261226

12271227
select null<=>json_extract('1',json_object(null,'{ }',null,null),'{}');
12281228

1229+
--echo #
1230+
--echo # MDEV-39213: json range syntax crash
1231+
--echo #
1232+
1233+
SELECT JSON_EXISTS(CONCAT('[', REPEAT('[', 4000), 'Y', REPEAT(']', 4000), ', 1]'), '$[100]');
1234+
12291235
--echo #
12301236
--echo # MDEV-35548 UBSAN: runtime error: index -1 out of bounds for type 'json_path_step_t[32]'
12311237
--echo # (aka 'struct st_json_path_step_t[32]')

‎sql/item_jsonfunc.cc‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -672,7 +672,7 @@ bool Item_func_json_exists::fix_length_and_dec(THD *thd)
672672
bool Item_func_json_exists::val_bool()
673673
{
674674
json_engine_t je;
675-
int array_counters[JSON_DEPTH_LIMIT];
675+
int array_counters[JSON_DEPTH_LIMIT]= {0};
676676

677677
String *js= args[0]->val_json(&tmp_js);
678678

@@ -738,7 +738,7 @@ bool Json_path_extractor::extract(String *str, Item *item_js, Item *item_jp,
738738
{
739739
String *js= item_js->val_json(&tmp_js);
740740
int error= 0;
741-
int array_counters[JSON_DEPTH_LIMIT];
741+
int array_counters[JSON_DEPTH_LIMIT]= {0};
742742

743743
if (!parsed)
744744
{
@@ -1597,7 +1597,7 @@ bool Item_func_json_contains::val_bool()
15971597

15981598
if (arg_count>2) /* Path specified. */
15991599
{
1600-
int array_counters[JSON_DEPTH_LIMIT];
1600+
int array_counters[JSON_DEPTH_LIMIT]= {0};
16011601
if (!path.parsed)
16021602
{
16031603
String *s_p= args[2]->val_str(&tmp_path);
@@ -1734,7 +1734,7 @@ longlong Item_func_json_contains_path::val_int()
17341734
result= !mode_one;
17351735
for (n_arg=2; n_arg < arg_count; n_arg++)
17361736
{
1737-
int array_counters[JSON_DEPTH_LIMIT];
1737+
int array_counters[JSON_DEPTH_LIMIT]= {0};
17381738
json_path_with_flags *c_path= paths + n_arg - 2;
17391739
if (!c_path->parsed)
17401740
{
@@ -2144,7 +2144,7 @@ String *Item_func_json_array_append::val_str(String *str)
21442144

21452145
for (n_arg=1, n_path=0; n_arg < arg_count; n_arg+=2, n_path++)
21462146
{
2147-
int array_counters[JSON_DEPTH_LIMIT];
2147+
int array_counters[JSON_DEPTH_LIMIT]= {0};
21482148
json_path_with_flags *c_path= paths + n_path;
21492149
if (!c_path->parsed)
21502150
{
@@ -2276,7 +2276,7 @@ String *Item_func_json_array_insert::val_str(String *str)
22762276

22772277
for (n_arg=1, n_path=0; n_arg < arg_count; n_arg+=2, n_path++)
22782278
{
2279-
int array_counters[JSON_DEPTH_LIMIT];
2279+
int array_counters[JSON_DEPTH_LIMIT]= {0};
22802280
json_path_with_flags *c_path= paths + n_path;
22812281
const char *item_pos;
22822282
int n_item, corrected_n_item;
@@ -3129,7 +3129,7 @@ longlong Item_func_json_length::val_int()
31293129
String *js= args[0]->val_json(&tmp_js);
31303130
json_engine_t je;
31313131
uint length= 0;
3132-
int array_counters[JSON_DEPTH_LIMIT];
3132+
int array_counters[JSON_DEPTH_LIMIT]= {0};
31333133
int err;
31343134

31353135
if ((null_value= args[0]->null_value))
@@ -3370,7 +3370,7 @@ String *Item_func_json_insert::val_str(String *str)
33703370

33713371
for (n_arg=1, n_path=0; n_arg < arg_count; n_arg+=2, n_path++)
33723372
{
3373-
int array_counters[JSON_DEPTH_LIMIT];
3373+
int array_counters[JSON_DEPTH_LIMIT]= {0};
33743374
json_path_with_flags *c_path= paths + n_path;
33753375
const char *v_to;
33763376
json_path_step_t *lp;
@@ -3635,7 +3635,7 @@ String *Item_func_json_remove::val_str(String *str)
36353635

36363636
for (n_arg=1, n_path=0; n_arg < arg_count; n_arg++, n_path++)
36373637
{
3638-
int array_counters[JSON_DEPTH_LIMIT];
3638+
int array_counters[JSON_DEPTH_LIMIT]= {0};
36393639
json_path_with_flags *c_path= paths + n_path;
36403640
const char *rem_start= 0, *rem_end;
36413641
json_path_step_t *lp;
@@ -3858,7 +3858,7 @@ String *Item_func_json_keys::val_str(String *str)
38583858
json_engine_t je;
38593859
String *js= args[0]->val_json(&tmp_js);
38603860
uint n_keys= 0;
3861-
int array_counters[JSON_DEPTH_LIMIT];
3861+
int array_counters[JSON_DEPTH_LIMIT]= {0};
38623862

38633863
if ((args[0]->null_value))
38643864
goto null_return;

‎sql/json_table.cc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -540,7 +540,7 @@ int ha_json_table::fill_column_values(THD *thd, uchar * buf, uchar *pos)
540540
{
541541
json_engine_t je;
542542
json_path_step_t *cur_step;
543-
int array_counters[JSON_DEPTH_LIMIT];
543+
int array_counters[JSON_DEPTH_LIMIT]= {0};
544544
int not_found;
545545
const uchar* node_start;
546546
const uchar* node_end;

‎strings/json_lib.c‎

Lines changed: 18 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1469,14 +1469,26 @@ int json_find_path(json_engine_t *je,
14691469
json_skip_array_item(je);
14701470
break;
14711471
case JST_OBJ_END:
1472-
do
1473-
{
1474-
(*p_cur_step)--;
1475-
} while (*p_cur_step > p->steps &&
1476-
array_counters[*p_cur_step - p->steps] == SKIPPED_STEP_MARK);
1472+
/*
1473+
MSAN-safe block
1474+
*/
1475+
while (*p_cur_step > p->steps)
1476+
{
1477+
json_path_step_t *prev = *p_cur_step;
1478+
prev--;
1479+
1480+
if (prev < p->steps)
1481+
break;
1482+
1483+
*p_cur_step = prev;
1484+
1485+
if (array_counters[prev - p->steps] != SKIPPED_STEP_MARK)
1486+
break;
1487+
}
14771488
break;
14781489
case JST_ARRAY_END:
1479-
(*p_cur_step)--;
1490+
if (*p_cur_step > p->steps)
1491+
(*p_cur_step)--;
14801492
break;
14811493
default:
14821494
DBUG_ASSERT(0);

‎unittest/json_lib/json_lib-t.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -140,7 +140,7 @@ test_search()
140140
json_path_t p;
141141
json_path_step_t *cur_step;
142142
int n_matches, scal_values;
143-
int array_counters[JSON_DEPTH_LIMIT];
143+
int array_counters[JSON_DEPTH_LIMIT]= {0};
144144

145145
if (json_scan_start(&je, ci, s_e(fj0)) ||
146146
json_path_setup(&p, ci, s_e(fp0)))

0 commit comments

Comments
 (0)