MDEV-25461 Assertion `je->state == JST_KEY' failed in Geometry::creat…

…e_from_json. Handle invalid GEOJSON-s in Geometry::create_from_json().
MariaDB · Jun 28, 2021 · 8147d2e · 8147d2e
1 parent 4e4f742
commit 8147d2e
Show file tree

Hide file tree

Showing 3 changed files with 23 additions and 0 deletions.
diff --git a/mysql-test/r/gis-json.result b/mysql-test/r/gis-json.result
@@ -107,6 +107,16 @@ Warning	4076	Incorrect GeoJSON format - empty 'coordinates' array.
 SELECT ST_GEOMFROMGEOJSON("{ \"type\": \"Feature\", \"geometry\": [10, 20] }");
 ST_GEOMFROMGEOJSON("{ \"type\": \"Feature\", \"geometry\": [10, 20] }")
 NULL
+SELECT ST_ASTEXT (ST_GEOMFROMGEOJSON ('{ "type": "GEOMETRYCOLLECTION", "coordinates": [102.0, 0.0]}'));
+ST_ASTEXT (ST_GEOMFROMGEOJSON ('{ "type": "GEOMETRYCOLLECTION", "coordinates": [102.0, 0.0]}'))
+NULL
+Warnings:
+Warning	4048	Incorrect GeoJSON format specified for st_geomfromgeojson function.
+SELECT ST_ASTEXT(ST_GEOMFROMGEOJSON('{"type": ["POINT"], "coINates": [0,0] }'));
+ST_ASTEXT(ST_GEOMFROMGEOJSON('{"type": ["POINT"], "coINates": [0,0] }'))
+NULL
+Warnings:
+Warning	4048	Incorrect GeoJSON format specified for st_geomfromgeojson function.
 #
 # End of 10.2 tests
 #
diff --git a/mysql-test/t/gis-json.test b/mysql-test/t/gis-json.test
@@ -46,6 +46,13 @@ SELECT st_astext(st_geomfromgeojson('{"type": "MultiPolygon","coordinates": []}'
 
 SELECT ST_GEOMFROMGEOJSON("{ \"type\": \"Feature\", \"geometry\": [10, 20] }");
 
+#
+# MDEV-25461 Assertion `je->state == JST_KEY' failed in Geometry::create_from_json.
+#
+
+SELECT ST_ASTEXT (ST_GEOMFROMGEOJSON ('{ "type": "GEOMETRYCOLLECTION", "coordinates": [102.0, 0.0]}'));
+
+SELECT ST_ASTEXT(ST_GEOMFROMGEOJSON('{"type": ["POINT"], "coINates": [0,0] }'));
 --echo #
 --echo # End of 10.2 tests
 --echo #
diff --git a/sql/spatial.cc b/sql/spatial.cc
@@ -539,7 +539,11 @@ Geometry *Geometry::create_from_json(Geometry_buffer *buffer,
             goto handle_geometry_key;
           feature_type_found= 1;
         }
+        else /* can't understand the type. */
+          break;
       }
+      else /* The "type" value can only be string. */
+        break;
     }
     else if (key_len == coord_keyname_len &&
              memcmp(key_buf, coord_keyname, coord_keyname_len) == 0)
@@ -556,6 +560,8 @@ Geometry *Geometry::create_from_json(Geometry_buffer *buffer,
         coord_start= je->value_begin;
         if (ci && ci != &geometrycollection_class)
           goto create_geom;
+        if (json_skip_level(je))
+          goto err_return;
       }
     }
     else if (key_len == geometries_keyname_len &&