database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-29 05:21:33 +03:00
Code Activity

MDEV-31147 json_normalize does not work correctly with MSAN build

Browse Source 
json_normalize_number(): Avoid accessing str past str_len.
The function would seem to work incorrectly when some digits are
not followed by a decimal point (.) or an exponent (E or e).
This commit is contained in:
Marko Mäkelä
2023-04-28 12:15:45 +03:00
parent 5028b7c7c8
commit 7d967423fe
3 changed files with 36 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
mysql-test/main/func_json.result
View File

@ -1673,3 +1673,16 @@ DROP TABLE t;
# #
# End of 10.6 tests # End of 10.6 tests
# #
#
# MDEV-31147 json_normalize does not work correctly with MSAN build
#
CREATE TABLE t1 (val JSON);
ALTER TABLE t1 ADD COLUMN normalized_json JSON AS (JSON_NORMALIZE(val));
INSERT INTO t1 (val) VALUES ('15');
SELECT * FROM t1;
val normalized_json
15 1.5E1
DROP TABLE t1;
#
# End of 10.8 tests
#

13
mysql-test/main/func_json.test
View File

@ -1112,3 +1112,16 @@ DROP TABLE t;
--echo # --echo #
--echo # End of 10.6 tests --echo # End of 10.6 tests
--echo # --echo #
--echo #
--echo # MDEV-31147 json_normalize does not work correctly with MSAN build
--echo #
CREATE TABLE t1 (val JSON);
ALTER TABLE t1 ADD COLUMN normalized_json JSON AS (JSON_NORMALIZE(val));
INSERT INTO t1 (val) VALUES ('15');
SELECT * FROM t1;
DROP TABLE t1;
--echo #
--echo # End of 10.8 tests
--echo #

17
strings/json_normalize.c
View File

@ -147,13 +147,16 @@ json_normalize_number(DYNAMIC_STRING *out, const char *str, size_t str_len)
magnitude = (long)(j - 1); magnitude = (long)(j - 1);
/* skip the . */ if (i < str_len)
if (str[i] == '.') {
++i; /* skip the . */
if (str[i] == '.')
++i;
/* grab rest of digits before the E */ /* grab rest of digits before the E */
for (; i < str_len && str[i] != 'e' && str[i] != 'E'; ++i) for (; i < str_len && str[i] != 'e' && str[i] != 'E'; ++i)
buf[j++] = str[i]; buf[j++] = str[i];
}
/* trim trailing zeros */ /* trim trailing zeros */
for (k = j - 1; k && buf[k] == '0'; --k, --j) for (k = j - 1; k && buf[k] == '0'; --k, --j)
@ -187,7 +190,7 @@ json_normalize_number(DYNAMIC_STRING *out, const char *str, size_t str_len)
err|= dynstr_append_mem(out, STRING_WITH_LEN("E")); err|= dynstr_append_mem(out, STRING_WITH_LEN("E"));
if (str[i] == 'e' || str[i] == 'E') if (i < str_len && (str[i] == 'e' || str[i] == 'E'))
{ {
char *endptr = NULL; char *endptr = NULL;
/* skip the [eE] */ /* skip the [eE] */