MDEV-12364 Server crashes in __memcpy_sse2_unaligned / String::copy on

JSON_SEARCH with variables. Wrong index for the tmp_paths array in Item_func_json_search::val_str.
MariaDB · May 2, 2017 · 42ad4f2 · 42ad4f2
1 parent 7afcee4
commit 42ad4f2
Show file tree

Hide file tree

Showing 3 changed files with 12 additions and 1 deletion.
diff --git a/mysql-test/r/func_json.result b/mysql-test/r/func_json.result
@@ -629,3 +629,7 @@ j	p	json_remove(j, p)
 {"a":1,"b":2,"c":3}	$.b	{"a": 1, "c": 3}
 {"a":1,"b":2,"c":3}	$.c	{"a": 1, "b": 2}
 drop table t1;
+SET @str = 'bar', @path = '$';
+SELECT JSON_SEARCH('{"foo":"bar"}', 'all' , @str, '%', @path);
+JSON_SEARCH('{"foo":"bar"}', 'all' , @str, '%', @path)
+"$.foo"
diff --git a/mysql-test/t/func_json.test b/mysql-test/t/func_json.test
@@ -274,3 +274,10 @@ insert into t1 values
       ('{"a":1,"b":2,"c":3}','$.c');
 select j, p, json_remove(j, p) from t1;
 drop table t1;
+
+#
+# MDEV-12364 Server crashes in __memcpy_sse2_unaligned / String::copy on JSON_SEARCH with variables.
+#
+SET @str = 'bar', @path = '$';
+SELECT JSON_SEARCH('{"foo":"bar"}', 'all' , @str, '%', @path);
+
diff --git a/sql/item_jsonfunc.cc b/sql/item_jsonfunc.cc
@@ -2898,7 +2898,7 @@ String *Item_func_json_search::val_str(String *str)
     json_path_with_flags *c_path= paths + n_arg - 4;
     if (!c_path->parsed)
     {
-      String *s_p= args[n_arg]->val_str(tmp_paths + (n_arg-1));
+      String *s_p= args[n_arg]->val_str(tmp_paths + (n_arg-4));
       if (s_p &&
           json_path_setup(&c_path->p,s_p->charset(),(const uchar *) s_p->ptr(),
                           (const uchar *) s_p->ptr() + s_p->length()))