database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2026-10-23 18:49:29 +03:00
Code Activity

MDEV-40414 Server crash in Charset::charset upon JSON operations

Browse Source 
JSON_EQUALS didn't check that ::val_str() of its arguments
where not-null before attempting to test their equality.

JSON_OVERLAPS also ensure that ::val_json() isn't null.
This commit is contained in:
Daniel Black
2026-07-21 16:43:53 +10:00
parent ba543f7e5a
commit 8370daf768
3 changed files with 21 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
mysql-test/main/func_json.result
View File

@@ -2950,4 +2950,13 @@ JSON_EXTRACT('0E+0','$')
SELECT JSON_ARRAY_INSERT (0,NULL,1) as j;
j
NULL
#
# MDEV-40414 Server crash in Charset::charset upon JSON operations
#
SELECT JSON_EQUALS('[]', JSON_ARRAY_INSERT(NULL,'$[0]',1)) AS x;
x
NULL
SELECT JSON_OVERLAPS(JSON_ARRAY_INSERT(NULL,'$[0]',1), '[]') AS x;
x
NULL
# End of 10.11 Test

7
mysql-test/main/func_json.test
View File

@@ -2123,4 +2123,11 @@ SELECT JSON_EXTRACT('0E+0','$');
SELECT JSON_ARRAY_INSERT (0,NULL,1) as j;
--echo #
--echo # MDEV-40414 Server crash in Charset::charset upon JSON operations
--echo #
SELECT JSON_EQUALS('[]', JSON_ARRAY_INSERT(NULL,'$[0]',1)) AS x;
SELECT JSON_OVERLAPS(JSON_ARRAY_INSERT(NULL,'$[0]',1), '[]') AS x;
--echo # End of 10.11 Test

6
sql/item_jsonfunc.cc
View File

@@ -629,7 +629,11 @@ bool Item_func_json_equals::val_bool()
return 1;
String *a= args[0]->val_json(&a_tmp);
if ((null_value= a == nullptr))
return 1;
String *b= args[1]->val_json(&b_tmp);
if ((null_value= b == nullptr))
return 1;
DYNAMIC_STRING a_res;
if (init_dynamic_string(&a_res, NULL, 0, 0))
@@ -5043,7 +5047,7 @@ bool Item_func_json_overlaps::val_bool()
int result;
THD *thd;
if ((null_value= args[0]->null_value))
if ((null_value= (js == nullptr) || args[0]->null_value))
return 0;
thd= current_thd;