database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-08-08 11:22:35 +03:00
Code Activity

MDEV-28326: Server crashes in json_path_parts_compare

Browse Source 
Analysis: When trying to compare json paths, the array_sizes variable is
NULL when beginning. But trying to access address by adding to the NULL
pointer while recursive calling json_path_parts_compare() for handling
double wildcard, it causes undefined behaviour and the array_sizes
variable eventually becomes non-null (has some address).
This eventually results in crash.
Fix: If array_sizes variable is NULL then pass NULL recursively as well.
This commit is contained in:
Rucha Deodhar
2022-04-18 15:31:36 +05:30
parent 375b8f40ce
commit 3716eaff4e
3 changed files with 21 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
mysql-test/main/func_json.result
View File

@@ -2278,5 +2278,11 @@ SELECT JSON_EXISTS(@json, '$[2][2][1 to 4]');
JSON_EXISTS(@json, '$[2][2][1 to 4]')
1
#
# MDEV-28326: Server crashes in json_path_parts_compare
#
SELECT * FROM JSON_TABLE('{"foo":["bar","qux"]}','$**.*[0]' COLUMNS(col1 CHAR(8) PATH '$[0]')) AS jt;
col1
bar
#
# End of 10.9 Test
#