From 9554ef067878c4650ef4b9ad44e0b222cdb313a5 Mon Sep 17 00:00:00 2001
From: Alexey Botchkov <holyfoot@askmonty.org>
Date: Thu, 12 Sep 2019 11:12:55 +0400
Subject: [PATCH] MDEV-19670 json escaped unicode parse error.

Fixed 4-byte length characters handled incorrectly.
---
 mysql-test/main/func_json.result | 9 +++++++++
 mysql-test/main/func_json.test   | 7 +++++++
 strings/json_lib.c               | 4 +++-
 3 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/mysql-test/main/func_json.result b/mysql-test/main/func_json.result
index 4faa6f44f9f..b6f49c82895 100644
--- a/mysql-test/main/func_json.result
+++ b/mysql-test/main/func_json.result
@@ -942,5 +942,14 @@ def					json_depnth	3	10	1	N	32897	0	63
 json_length	json_depnth
 2	3
 #
+# MDEV-19670 json escaped unicode parse error
+#
+SELECT json_valid('{"value":"\\ud83d\\ude0a"}');
+json_valid('{"value":"\\ud83d\\ude0a"}')
+1
+SELECT json_valid('{"test": "\\ud83d\\ude0b"}');
+json_valid('{"test": "\\ud83d\\ude0b"}')
+1
+#
 # End of 10.3 tests
 #
diff --git a/mysql-test/main/func_json.test b/mysql-test/main/func_json.test
index 33f8a598670..ccee538e74f 100644
--- a/mysql-test/main/func_json.test
+++ b/mysql-test/main/func_json.test
@@ -561,6 +561,13 @@ SELECT
 --enable_ps_protocol
 --disable_metadata
 
+--echo #
+--echo # MDEV-19670 json escaped unicode parse error
+--echo #
+
+SELECT json_valid('{"value":"\\ud83d\\ude0a"}');
+SELECT json_valid('{"test": "\\ud83d\\ude0b"}');
+
 --echo #
 --echo # End of 10.3 tests
 --echo #
diff --git a/strings/json_lib.c b/strings/json_lib.c
index 24c79cb9044..77b41dceb20 100644
--- a/strings/json_lib.c
+++ b/strings/json_lib.c
@@ -320,15 +320,17 @@ static int json_handle_esc(json_string_t *s)
     if (s->c_next != '\\')
       return s->error= JE_SYN;
 
+    s->c_str+= c_len;
     if ((c_len= json_next_char(s)) <= 0)
       return s->error= json_eos(s) ? JE_EOS : JE_BAD_CHR;
     if (s->c_next != 'u')
       return s->error= JE_SYN;
+    s->c_str+= c_len;
 
     if (read_4_hexdigits(s, code+2))
       return 1;
 
-    if ((c_len= my_utf16_uni(0, &s->c_next, code, code+4)) == 2)
+    if ((c_len= my_utf16_uni(0, &s->c_next, code, code+4)) == 4)
       return 0;
   }
   return s->error= JE_BAD_CHR;