Skip to content

Commit 95989e8

Browse files
MDEV-28762: recursive call of some json functions without stack control
This commit is a fixup for MDEV-28762 Analysis: Some recursive json functions dont check for stack control Fix: Add check_stack_overrun(). The last argument is NULL because it is not used
1 parent 4bc34ef commit 95989e8

File tree

3 files changed

+23
-12
lines changed

3 files changed

+23
-12
lines changed

mysql-test/main/json_debug_nonembedded.result

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,8 @@
44
#
55
SET @saved_dbug = @@debug_dbug;
66
SET debug_dbug='+d,json_check_min_stack_requirement';
7-
SET @json1= '{"key1":"val1"}';
8-
SET @json2= '{"key1":"val1"}';
7+
SET @json1= '{"key1":{"key1":"val1"}}';
8+
SET @json2= '{"key1":{"key1":"val1"}}';
99
SELECT JSON_CONTAINS(@json1, @json2);
1010
ERROR HY000: Thread stack overrun: 'used bytes' used of a 'available' byte stack, and 'X' bytes needed. Use 'mysqld --thread_stack=#' to specify a bigger stack
1111
SET debug_dbug='+d,temp';

mysql-test/main/json_debug_nonembedded.test

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@
99
SET @saved_dbug = @@debug_dbug;
1010
SET debug_dbug='+d,json_check_min_stack_requirement';
1111

12-
SET @json1= '{"key1":"val1"}';
13-
SET @json2= '{"key1":"val1"}';
12+
SET @json1= '{"key1":{"key1":"val1"}}';
13+
SET @json2= '{"key1":{"key1":"val1"}}';
1414

1515
--replace_regex /overrun: [0-9]* bytes used of a [0-9]* byte stack, and [0-9]* bytes needed/overrun: 'used bytes' used of a 'available' byte stack, and 'X' bytes needed/
1616
--error ER_STACK_OVERRUN_NEED_MORE

sql/item_jsonfunc.cc

Lines changed: 19 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,6 @@
2020
#include "item.h"
2121
#include "sql_parse.h" // For check_stack_overrun
2222

23-
2423
/*
2524
Compare ASCII string against the string with the specified
2625
character set.
@@ -136,9 +135,11 @@ int json_path_parts_compare(
136135
{
137136
int res, res2;
138137

138+
long arbitrary_var;
139+
long stack_used_up= (available_stack_size(current_thd->thread_stack, &arbitrary_var));
139140
DBUG_EXECUTE_IF("json_check_min_stack_requirement",
140-
{alloca(my_thread_stack_size-(STACK_MIN_SIZE));});
141-
if (check_stack_overrun(current_thd, STACK_MIN_SIZE, NULL))
141+
{alloca(my_thread_stack_size-stack_used_up-STACK_MIN_SIZE);});
142+
if (check_stack_overrun(current_thd, STACK_MIN_SIZE , NULL))
142143
return 1;
143144
while (a <= a_end)
144145
{
@@ -1135,6 +1136,12 @@ static int check_contains(json_engine_t *js, json_engine_t *value)
11351136
{
11361137
json_engine_t loc_js;
11371138
bool set_js;
1139+
long arbitrary_var;
1140+
long stack_used_up= (available_stack_size(current_thd->thread_stack, &arbitrary_var));
1141+
DBUG_EXECUTE_IF("json_check_min_stack_requirement",
1142+
{alloca(my_thread_stack_size-stack_used_up-STACK_MIN_SIZE);});
1143+
if (check_stack_overrun(current_thd, STACK_MIN_SIZE , NULL))
1144+
return 1;
11381145

11391146
DBUG_EXECUTE_IF("json_check_min_stack_requirement",
11401147
{alloca(my_thread_stack_size-(STACK_MIN_SIZE));});
@@ -2030,10 +2037,12 @@ String *Item_func_json_object::val_str(String *str)
20302037
static int do_merge(String *str, json_engine_t *je1, json_engine_t *je2)
20312038
{
20322039

2040+
long arbitrary_var;
2041+
long stack_used_up= (available_stack_size(current_thd->thread_stack, &arbitrary_var));
20332042
DBUG_EXECUTE_IF("json_check_min_stack_requirement",
2034-
{alloca(my_thread_stack_size-(STACK_MIN_SIZE));});
2035-
if (check_stack_overrun(current_thd, STACK_MIN_SIZE, NULL))
2036-
return 1;
2043+
{alloca(my_thread_stack_size-stack_used_up-STACK_MIN_SIZE);});
2044+
if (check_stack_overrun(current_thd, STACK_MIN_SIZE , NULL))
2045+
return 1;
20372046

20382047
if (json_read_value(je1) || json_read_value(je2))
20392048
return 1;
@@ -2367,9 +2376,11 @@ static int copy_value_patch(String *str, json_engine_t *je)
23672376
static int do_merge_patch(String *str, json_engine_t *je1, json_engine_t *je2,
23682377
bool *empty_result)
23692378
{
2379+
long arbitrary_var;
2380+
long stack_used_up= (available_stack_size(current_thd->thread_stack, &arbitrary_var));
23702381
DBUG_EXECUTE_IF("json_check_min_stack_requirement",
2371-
{alloca(my_thread_stack_size-(STACK_MIN_SIZE));});
2372-
if (check_stack_overrun(current_thd, STACK_MIN_SIZE, NULL))
2382+
{alloca(my_thread_stack_size-stack_used_up-STACK_MIN_SIZE);});
2383+
if (check_stack_overrun(current_thd, STACK_MIN_SIZE , NULL))
23732384
return 1;
23742385

23752386
if (json_read_value(je1) || json_read_value(je2))

0 commit comments

Comments
 (0)