MDEV-13971 crash in skip_num_constant.

Character bigger than 0x60 wasn't handled properly inside a numeric constant.
MariaDB · Nov 11, 2017 · 1e2d4f6 · 1e2d4f6
1 parent dcbf282
commit 1e2d4f6
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 1 deletion.
diff --git a/mysql-test/r/func_json.result b/mysql-test/r/func_json.result
@@ -725,3 +725,6 @@ json_contains_path('{"foo":"bar"}', 'one', '$[]')
 NULL
 Warnings:
 Warning	4042	Syntax error in JSON path in argument 3 to function 'json_contains_path' at position 3
+select JSON_VALID(0x36f0c8dccd83c5eac156da);
+JSON_VALID(0x36f0c8dccd83c5eac156da)
+0
diff --git a/mysql-test/t/func_json.test b/mysql-test/t/func_json.test
@@ -378,3 +378,7 @@ SELECT JSON_OBJECT("user","Jožko Mrkvičká") as json_data;
 
 select json_contains_path('{"foo":"bar"}', 'one', '$[]');
 
+#
+# MDEV-13971 crash in skip_num_constant.
+#
+select JSON_VALID(0x36f0c8dccd83c5eac156da);
diff --git a/strings/json_lib.c b/strings/json_lib.c
@@ -503,7 +503,7 @@ static int skip_num_constant(json_engine_t *j)
   for (;;)
   {
     j->num_flags|= json_num_state_flags[state];
-    if ((c_len= json_next_char(&j->s)) > 0)
+    if ((c_len= json_next_char(&j->s)) > 0 && j->s.c_next < 128)
     {
       if ((state= json_num_states[state][json_num_chr_map[j->s.c_next]]) > 0)
       {