MDEV-13971 crash in skip_num_constant.

Alexey Botchkov · Alexey Botchkov · commit 1e2d4f677e08 · 2017-11-11T13:54:56.000+04:00
Character bigger than 0x60 wasn't handled properly
        inside a numeric constant.
diff --git a/mysql-test/r/func_json.result b/mysql-test/r/func_json.result
@@ -725,3 +725,6 @@ json_contains_path('{"foo":"bar"}', 'one', '$[]')
 NULL
 Warnings:
 Warning	4042	Syntax error in JSON path in argument 3 to function 'json_contains_path' at position 3
+select JSON_VALID(0x36f0c8dccd83c5eac156da);
+JSON_VALID(0x36f0c8dccd83c5eac156da)
+0
diff --git a/mysql-test/t/func_json.test b/mysql-test/t/func_json.test
@@ -378,3 +378,7 @@ SELECT JSON_OBJECT("user","Jožko Mrkvičká") as json_data;
 
 select json_contains_path('{"foo":"bar"}', 'one', '$[]');
 
+#
+# MDEV-13971 crash in skip_num_constant.
+#
+select JSON_VALID(0x36f0c8dccd83c5eac156da);
diff --git a/strings/json_lib.c b/strings/json_lib.c
@@ -503,7 +503,7 @@ static int skip_num_constant(json_engine_t *j)
   for (;;)
   {
     j->num_flags|= json_num_state_flags[state];
-    if ((c_len= json_next_char(&j->s)) > 0)
+    if ((c_len= json_next_char(&j->s)) > 0 && j->s.c_next < 128)
     {
       if ((state= json_num_states[state][json_num_chr_map[j->s.c_next]]) > 0)
       {

Original file line number	Diff line number	Diff line change
`@@ -503,7 +503,7 @@ static int skip_num_constant(json_engine_t *j)`
`503`	`503`	`for (;;)`
`504`	`504`	`{`
`505`	`505`	`j->num_flags\|= json_num_state_flags[state];`
`506`		`- if ((c_len= json_next_char(&j->s)) > 0)`
	`506`	`+ if ((c_len= json_next_char(&j->s)) > 0 && j->s.c_next < 128)`
`507`	`507`	`{`
`508`	`508`	`if ((state= json_num_states[state][json_num_chr_map[j->s.c_next]]) > 0)`
`509`	`509`	`{`