database/mariadb-columnstore-engine
1
0
Fork 0
mirror of https://github.com/mariadb-corporation/mariadb-columnstore-engine.git synced 2025-07-29 08:21:15 +03:00
Code Activity

Fix for JSON_VALUE function to remove OOB stack access (#2852)

Browse Source 
MCOL-271 introduced a bug in JSON_VALUE that was discovered during
implementation of ASAN builds. The changes here restore normal
functionality.

In short, changes in MCOL-271 introduced a local variable instead of
reference to a string in ConstantColumn's fResult.strVal. The handling
of ConstantColumn is different because ConstantColumn's value is used
to initialize JSON path once. JSON path value holds pointer to data it
does not own and if there are two or more rows the data can be corrupted
and/or be out of stack bounds.

The changes here introduce reference to a NullString that is held in the
ConstantColumn's fResult.strVal and uses appropriate functions to obtain
data from the NullString. CC's fResult is held by CC and strVal is also
neither changing nor moving during operation, which allow JSON path to
hold correct pointers during multi-row operation.
This commit is contained in:
Sergey Zefirov
2023-05-31 15:30:40 +03:00
committed by GitHub
parent 32482cd928
commit 0a2e9760ee
1 changed files with 3 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
utils/funcexp/func_json_value.cpp
View File

@ -64,8 +64,7 @@ bool JSONPathWrapper::extract(std::string& ret, rowgroup::Row& row, execplan::SP
bool isNullJS = false, isNullPath = false;
const string js = funcParamJS->data()->getStrVal(row, isNullJS).safeString("");
const string sjsp = funcParamPath->data()->getStrVal(row, isNullPath).safeString("");
const string_view jsp = sjsp;
const utils::NullString& sjsp = funcParamPath->data()->getStrVal(row, isNullPath);
if (isNullJS || isNullPath)
return true;
@ -79,8 +78,8 @@ bool JSONPathWrapper::extract(std::string& ret, rowgroup::Row& row, execplan::SP
constant = (constCol != nullptr);
}
if (isNullPath || json_path_setup(&p, getCharset(funcParamPath), (const uchar*)jsp.data(),
(const uchar*)jsp.data() + jsp.size()))
if (isNullPath || json_path_setup(&p, getCharset(funcParamPath), (const uchar*)sjsp.str(),
(const uchar*)sjsp.end()))
return true;
parsed = constant;