database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2026-10-23 18:49:29 +03:00
Code Activity

MDEV-40678 mysql_json plugin OOB reads

Browse Source
This commit is contained in:
Sergei Golubchik
2026-08-09 09:53:09 +02:00
parent 0931994096
commit 851f52470d
3 changed files with 50 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
mysql-test/main/mysql_json_table_recreate.result
View File

@@ -245,6 +245,14 @@ DECLARE a mysql_json;
END;
$$
ERROR HY000: 'MYSQL_JSON' is not allowed in this context
#
# End of 10.5 tests
#
# MDEV-40678 mysql_json plugin OOB reads
#
alter table t1 force;
ERROR HY000: Error parsing MySQL JSON format, please dump this table from MySQL and then restore it to be able to use it in MariaDB.
flush tables;
alter table t1 force;
ERROR HY000: Error parsing MySQL JSON format, please dump this table from MySQL and then restore it to be able to use it in MariaDB.
drop table t1;
# End of 10.6 tests

38
mysql-test/main/mysql_json_table_recreate.test
View File

@@ -17,7 +17,7 @@ call mtr.add_suppression("Table rebuild required");
call mtr.add_suppression("is marked as crashed");
call mtr.add_suppression("Checking");
let $MYSQLD_DATADIR= `select @@datadir`;
let MYSQLD_DATADIR= `select @@datadir`;
SET NAMES utf8;
@@ -161,6 +161,40 @@ END;
$$
DELIMITER ;$$
--echo #
--echo # End of 10.5 tests
--echo #
--echo # MDEV-40678 mysql_json plugin OOB reads
--echo #
--copy_file std_data/mysql_json/mysql_json_test.frm $MYSQLD_DATADIR/test/t1.frm
--copy_file std_data/mysql_json/mysql_json_test.MYI $MYSQLD_DATADIR/test/t1.MYI
--copy_file std_data/mysql_json/mysql_json_test.MYD $MYSQLD_DATADIR/test/t1.MYD
perl;
my $f="$ENV{MYSQLD_DATADIR}/test/t1.MYD";
open F, '+<', $f or die "open($f): $!";
sysseek F, 0x3c5, 0 or die "sysseek: $!";
syswrite F, '(' or die "syswrite: $!";
EOF
--error ER_UNKNOWN_ERROR
alter table t1 force;
flush tables;
--remove_file $MYSQLD_DATADIR/test/t1.MYD
--copy_file std_data/mysql_json/mysql_json_test.MYD $MYSQLD_DATADIR/test/t1.MYD
perl;
my $f="$ENV{MYSQLD_DATADIR}/test/t1.MYD";
open F, '+<', $f or die "open($f): $!";
sysseek F, 0x3bc, 0 or die "sysseek: $!";
syswrite F, '(' or die "syswrite: $!";
EOF
--error ER_UNKNOWN_ERROR
alter table t1 force;
drop table t1;
--echo # End of 10.6 tests

8
plugin/type_mysql_json/mysql_json.cc
View File

@@ -373,7 +373,8 @@ static bool parse_mysql_scalar_or_value(String *buffer, const uchar *data,
if (type_is_stored_inline(value_type, large))
{
const size_t value_start = value_type_offset + 1;
if (parse_mysql_scalar(buffer, value_type, data + value_start,
if (value_start >= len ||
parse_mysql_scalar(buffer, value_type, data + value_start,
len - value_start))
return true;
}
@@ -383,7 +384,8 @@ static bool parse_mysql_scalar_or_value(String *buffer, const uchar *data,
of the Object / Array */
const size_t value_start= read_offset_or_size(
data + value_type_offset + 1, large);
if (parse_mysql_json_value(buffer, value_type, data + value_start,
if (value_start >= len ||
parse_mysql_json_value(buffer, value_type, data + value_start,
len - value_start, depth))
return true;
}
@@ -453,7 +455,7 @@ static bool parse_array_or_object(String *buffer, const uchar *data, size_t len,
i * value_size(large));
/* First print the key. */
if (buffer->append('"') ||
if (key_start + key_len > bytes || buffer->append('"') ||
append_string_json(buffer, data + key_start, key_len) ||
buffer->append(STRING_WITH_LEN("\": ")))
{