Skip to content

Commit

Permalink
MDEV-26392: Crash with json_get_path_next and 10.5.12
Browse files Browse the repository at this point in the history
Analysis:
When we skip level when path is found, it changes the state of the json
engine. This breaks the sequence for json_get_path_next() which is called at
the end to ensure json document is valid and leads to crash.
Fix:
Use json_scan_next() at the end to check if json document has correct
syntax (is valid).
  • Loading branch information
mariadb-RuchaDeodhar committed Jan 18, 2023
1 parent 0459d2c commit ff72a94
Show file tree
Hide file tree
Showing 3 changed files with 25 additions and 1 deletion.
12 changes: 12 additions & 0 deletions mysql-test/main/func_json.result
Original file line number Diff line number Diff line change
Expand Up @@ -1611,5 +1611,17 @@ SELECT json_object('a', coalesce(json_object('b', 'c')));
json_object('a', coalesce(json_object('b', 'c')))
{"a": {"b": "c"}}
#
# MDEV-26392: Crash with json_get_path_next and 10.5.12
#
CREATE TABLE arrNestTest (
id VARCHAR(80) AS (JSON_COMPACT(JSON_EXTRACT(doc, "$._id"))) UNIQUE KEY,
doc JSON,
CONSTRAINT id_not_null CHECK(id IS NOT NULL));
INSERT INTO test.arrNestTest (doc) VALUES ('{ "_id" : { "$oid" : "611c0a463b150154132f6636" }, "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : 1.0 } ] } ] } ] } ] } ] } ] } ] } ] } ] } ] } ] } ] } ] } ] } ] }');
SELECT * FROM arrNestTest;
id doc
{"$oid":"611c0a463b150154132f6636"} { "_id" : { "$oid" : "611c0a463b150154132f6636" }, "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : 1.0 } ] } ] } ] } ] } ] } ] } ] } ] } ] } ] } ] } ] } ] } ] } ] }
DROP TABLE arrNestTest;
#
# End of 10.5 tests
#
12 changes: 12 additions & 0 deletions mysql-test/main/func_json.test
Original file line number Diff line number Diff line change
Expand Up @@ -1054,6 +1054,18 @@ DROP TABLE t2;
SELECT json_object('a', if(1, json_object('b', 'c'), json_object('e', 'f')));
SELECT json_object('a', coalesce(json_object('b', 'c')));

--echo #
--echo # MDEV-26392: Crash with json_get_path_next and 10.5.12
--echo #

CREATE TABLE arrNestTest (
id VARCHAR(80) AS (JSON_COMPACT(JSON_EXTRACT(doc, "$._id"))) UNIQUE KEY,
doc JSON,
CONSTRAINT id_not_null CHECK(id IS NOT NULL));

INSERT INTO test.arrNestTest (doc) VALUES ('{ "_id" : { "$oid" : "611c0a463b150154132f6636" }, "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : 1.0 } ] } ] } ] } ] } ] } ] } ] } ] } ] } ] } ] } ] } ] } ] } ] }');
SELECT * FROM arrNestTest;
DROP TABLE arrNestTest;

--echo #
--echo # End of 10.5 tests
Expand Down
2 changes: 1 addition & 1 deletion sql/item_jsonfunc.cc
Original file line number Diff line number Diff line change
Expand Up @@ -994,7 +994,7 @@ String *Item_func_json_extract::read_json(String *str,
if (!possible_multiple_values)
{
/* Loop to the end of the JSON just to make sure it's valid. */
while (json_get_path_next(&je, &p) == 0) {}
while (json_scan_next(&je) == 0) {}
break;
}
}
Expand Down

0 comments on commit ff72a94

Please sign in to comment.