Skip to content

Commit 7582e48

Browse files
sanja-byelkinsanja-byelkin
committed
Merge branch 'bb-10.11-release' into bb-11.4-release
2 parents dacd2a9 + aad585e commit 7582e48

6 files changed

Lines changed: 42 additions & 18 deletions

File tree

‎mysql-test/main/func_json.result‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1771,6 +1771,12 @@ null<=>json_extract('1',json_object(null,'{ }',null,null),'{}')
17711771
Warnings:
17721772
Warning 4042 Syntax error in JSON path in argument 2 to function 'json_extract' at position 1
17731773
#
1774+
# MDEV-39213: json range syntax crash
1775+
#
1776+
SELECT JSON_EXISTS(CONCAT('[', REPEAT('[', 4000), 'Y', REPEAT(']', 4000), ', 1]'), '$[100]');
1777+
JSON_EXISTS(CONCAT('[', REPEAT('[', 4000), 'Y', REPEAT(']', 4000), ', 1]'), '$[100]')
1778+
NULL
1779+
#
17741780
# MDEV-35548 UBSAN: runtime error: index -1 out of bounds for type 'json_path_step_t[32]'
17751781
# (aka 'struct st_json_path_step_t[32]')
17761782
#

‎mysql-test/main/func_json.test‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1216,6 +1216,12 @@ FROM JSON_TABLE (@data, '$[*]' COLUMNS (data text PATH '$.Data')) AS t;
12161216

12171217
select null<=>json_extract('1',json_object(null,'{ }',null,null),'{}');
12181218

1219+
--echo #
1220+
--echo # MDEV-39213: json range syntax crash
1221+
--echo #
1222+
1223+
SELECT JSON_EXISTS(CONCAT('[', REPEAT('[', 4000), 'Y', REPEAT(']', 4000), ', 1]'), '$[100]');
1224+
12191225
--echo #
12201226
--echo # MDEV-35548 UBSAN: runtime error: index -1 out of bounds for type 'json_path_step_t[32]'
12211227
--echo # (aka 'struct st_json_path_step_t[32]')

‎sql/item_jsonfunc.cc‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -672,7 +672,7 @@ bool Item_func_json_exists::fix_length_and_dec(THD *thd)
672672
bool Item_func_json_exists::val_bool()
673673
{
674674
json_engine_t je;
675-
int array_counters[JSON_DEPTH_LIMIT];
675+
int array_counters[JSON_DEPTH_LIMIT]= {0};
676676

677677
String *js= args[0]->val_json(&tmp_js);
678678

@@ -738,7 +738,7 @@ bool Json_path_extractor::extract(String *str, Item *item_js, Item *item_jp,
738738
{
739739
String *js= item_js->val_json(&tmp_js);
740740
int error= 0;
741-
int array_counters[JSON_DEPTH_LIMIT];
741+
int array_counters[JSON_DEPTH_LIMIT]= {0};
742742

743743
if (!parsed)
744744
{
@@ -1568,7 +1568,7 @@ bool Item_func_json_contains::val_bool()
15681568

15691569
if (arg_count>2) /* Path specified. */
15701570
{
1571-
int array_counters[JSON_DEPTH_LIMIT];
1571+
int array_counters[JSON_DEPTH_LIMIT]= {0};
15721572
if (!path.parsed)
15731573
{
15741574
String *s_p= args[2]->val_str(&tmp_path);
@@ -1705,7 +1705,7 @@ longlong Item_func_json_contains_path::val_int()
17051705
result= !mode_one;
17061706
for (n_arg=2; n_arg < arg_count; n_arg++)
17071707
{
1708-
int array_counters[JSON_DEPTH_LIMIT];
1708+
int array_counters[JSON_DEPTH_LIMIT]= {0};
17091709
json_path_with_flags *c_path= paths + n_arg - 2;
17101710
if (!c_path->parsed)
17111711
{
@@ -2115,7 +2115,7 @@ String *Item_func_json_array_append::val_str(String *str)
21152115

21162116
for (n_arg=1, n_path=0; n_arg < arg_count; n_arg+=2, n_path++)
21172117
{
2118-
int array_counters[JSON_DEPTH_LIMIT];
2118+
int array_counters[JSON_DEPTH_LIMIT]= {0};
21192119
json_path_with_flags *c_path= paths + n_path;
21202120
if (!c_path->parsed)
21212121
{
@@ -2247,7 +2247,7 @@ String *Item_func_json_array_insert::val_str(String *str)
22472247

22482248
for (n_arg=1, n_path=0; n_arg < arg_count; n_arg+=2, n_path++)
22492249
{
2250-
int array_counters[JSON_DEPTH_LIMIT];
2250+
int array_counters[JSON_DEPTH_LIMIT]= {0};
22512251
json_path_with_flags *c_path= paths + n_path;
22522252
const char *item_pos;
22532253
int n_item, corrected_n_item;
@@ -3100,7 +3100,7 @@ longlong Item_func_json_length::val_int()
31003100
String *js= args[0]->val_json(&tmp_js);
31013101
json_engine_t je;
31023102
uint length= 0;
3103-
int array_counters[JSON_DEPTH_LIMIT];
3103+
int array_counters[JSON_DEPTH_LIMIT]= {0};
31043104
int err;
31053105

31063106
if ((null_value= args[0]->null_value))
@@ -3341,7 +3341,7 @@ String *Item_func_json_insert::val_str(String *str)
33413341

33423342
for (n_arg=1, n_path=0; n_arg < arg_count; n_arg+=2, n_path++)
33433343
{
3344-
int array_counters[JSON_DEPTH_LIMIT];
3344+
int array_counters[JSON_DEPTH_LIMIT]= {0};
33453345
json_path_with_flags *c_path= paths + n_path;
33463346
const char *v_to;
33473347
json_path_step_t *lp;
@@ -3606,7 +3606,7 @@ String *Item_func_json_remove::val_str(String *str)
36063606

36073607
for (n_arg=1, n_path=0; n_arg < arg_count; n_arg++, n_path++)
36083608
{
3609-
int array_counters[JSON_DEPTH_LIMIT];
3609+
int array_counters[JSON_DEPTH_LIMIT]= {0};
36103610
json_path_with_flags *c_path= paths + n_path;
36113611
const char *rem_start= 0, *rem_end;
36123612
json_path_step_t *lp;
@@ -3829,7 +3829,7 @@ String *Item_func_json_keys::val_str(String *str)
38293829
json_engine_t je;
38303830
String *js= args[0]->val_json(&tmp_js);
38313831
uint n_keys= 0;
3832-
int array_counters[JSON_DEPTH_LIMIT];
3832+
int array_counters[JSON_DEPTH_LIMIT]= {0};
38333833

38343834
if ((args[0]->null_value))
38353835
goto null_return;

‎sql/json_table.cc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -540,7 +540,7 @@ int ha_json_table::fill_column_values(THD *thd, uchar * buf, uchar *pos)
540540
{
541541
json_engine_t je;
542542
json_path_step_t *cur_step;
543-
int array_counters[JSON_DEPTH_LIMIT];
543+
int array_counters[JSON_DEPTH_LIMIT]= {0};
544544
int not_found;
545545
const uchar* node_start;
546546
const uchar* node_end;

‎strings/json_lib.c‎

Lines changed: 18 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1469,14 +1469,26 @@ int json_find_path(json_engine_t *je,
14691469
json_skip_array_item(je);
14701470
break;
14711471
case JST_OBJ_END:
1472-
do
1473-
{
1474-
(*p_cur_step)--;
1475-
} while (*p_cur_step > p->steps &&
1476-
array_counters[*p_cur_step - p->steps] == SKIPPED_STEP_MARK);
1472+
/*
1473+
MSAN-safe block
1474+
*/
1475+
while (*p_cur_step > p->steps)
1476+
{
1477+
json_path_step_t *prev = *p_cur_step;
1478+
prev--;
1479+
1480+
if (prev < p->steps)
1481+
break;
1482+
1483+
*p_cur_step = prev;
1484+
1485+
if (array_counters[prev - p->steps] != SKIPPED_STEP_MARK)
1486+
break;
1487+
}
14771488
break;
14781489
case JST_ARRAY_END:
1479-
(*p_cur_step)--;
1490+
if (*p_cur_step > p->steps)
1491+
(*p_cur_step)--;
14801492
break;
14811493
default:
14821494
DBUG_ASSERT(0);

‎unittest/json_lib/json_lib-t.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -140,7 +140,7 @@ test_search()
140140
json_path_t p;
141141
json_path_step_t *cur_step;
142142
int n_matches, scal_values;
143-
int array_counters[JSON_DEPTH_LIMIT];
143+
int array_counters[JSON_DEPTH_LIMIT]= {0};
144144

145145
if (json_scan_start(&je, ci, s_e(fj0)) ||
146146
json_path_setup(&p, ci, s_e(fp0)))

0 commit comments

Comments
 (0)