database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-30 16:24:05 +03:00
Code Activity

MDEV-12364 Server crashes in __memcpy_sse2_unaligned / String::copy on

Browse Source 
JSON_SEARCH with variables.

        Wrong index for the tmp_paths array in
        Item_func_json_search::val_str.
This commit is contained in:
Alexey Botchkov
2017-05-02 14:28:57 +04:00
parent 7afcee4cf6
commit 42ad4f2821
3 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
mysql-test/r/func_json.result
View File

@ -629,3 +629,7 @@ j p json_remove(j, p)
{"a":1,"b":2,"c":3} $.b {"a": 1, "c": 3} {"a":1,"b":2,"c":3} $.b {"a": 1, "c": 3}
{"a":1,"b":2,"c":3} $.c {"a": 1, "b": 2} {"a":1,"b":2,"c":3} $.c {"a": 1, "b": 2}
drop table t1; drop table t1;
SET @str = 'bar', @path = '$';
SELECT JSON_SEARCH('{"foo":"bar"}', 'all' , @str, '%', @path);
JSON_SEARCH('{"foo":"bar"}', 'all' , @str, '%', @path)
"$.foo"

7
mysql-test/t/func_json.test
View File

@ -274,3 +274,10 @@ insert into t1 values
('{"a":1,"b":2,"c":3}','$.c'); ('{"a":1,"b":2,"c":3}','$.c');
select j, p, json_remove(j, p) from t1; select j, p, json_remove(j, p) from t1;
drop table t1; drop table t1;
#
# MDEV-12364 Server crashes in __memcpy_sse2_unaligned / String::copy on JSON_SEARCH with variables.
#
SET @str = 'bar', @path = '$';
SELECT JSON_SEARCH('{"foo":"bar"}', 'all' , @str, '%', @path);

2
sql/item_jsonfunc.cc
View File

@ -2898,7 +2898,7 @@ String *Item_func_json_search::val_str(String *str)
json_path_with_flags *c_path= paths + n_arg - 4; json_path_with_flags *c_path= paths + n_arg - 4;
if (!c_path->parsed) if (!c_path->parsed)
{ {
String *s_p= args[n_arg]->val_str(tmp_paths + (n_arg-1)); String *s_p= args[n_arg]->val_str(tmp_paths + (n_arg-4));
if (s_p && if (s_p &&
json_path_setup(&c_path->p,s_p->charset(),(const uchar *) s_p->ptr(), json_path_setup(&c_path->p,s_p->charset(),(const uchar *) s_p->ptr(),
(const uchar *) s_p->ptr() + s_p->length())) (const uchar *) s_p->ptr() + s_p->length()))