database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-08-01 03:47:19 +03:00
Code Activity

MDEV-11441 Server crashes in String::append /Item_func_json_extract::val_str.

Browse Source 
Wrong 'value_lengh' taken
This commit is contained in:
Alexey Botchkov
2016-12-03 10:53:12 +04:00
parent 1e2b46d5d5
commit b28626e842
3 changed files with 9 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
mysql-test/r/func_json.result
View File

@ -90,7 +90,7 @@ json_contains_path('{"key1":1, "key2":[2,3]}', "aLl", "$.key1", "$.key2")
1 1
select json_extract('{"key1":"asd", "key2":[2,3]}', "$.key1"); select json_extract('{"key1":"asd", "key2":[2,3]}', "$.key1");
json_extract('{"key1":"asd", "key2":[2,3]}', "$.key1") json_extract('{"key1":"asd", "key2":[2,3]}', "$.key1")
asd "asd"
select json_extract('{"key1":"asd", "key2":[2,3]}', "$.keyX", "$.keyY"); select json_extract('{"key1":"asd", "key2":[2,3]}', "$.keyX", "$.keyY");
json_extract('{"key1":"asd", "key2":[2,3]}', "$.keyX", "$.keyY") json_extract('{"key1":"asd", "key2":[2,3]}', "$.keyX", "$.keyY")
NULL NULL
@ -102,7 +102,10 @@ json_extract('{"key1":5, "key2":[2,3]}', "$.key1", "$.key2")
[5, [2,3]] [5, [2,3]]
select json_extract('{"key0":true, "key1":"qwe"}', "$.key1"); select json_extract('{"key0":true, "key1":"qwe"}', "$.key1");
json_extract('{"key0":true, "key1":"qwe"}', "$.key1") json_extract('{"key0":true, "key1":"qwe"}', "$.key1")
qwe "qwe"
select json_extract(json_object('foo', 'foobar'),'$');
json_extract(json_object('foo', 'foobar'),'$')
{"foo": "foobar"}
select json_insert('{"a":1, "b":{"c":1}, "d":[1, 2]}', '$.b.k1', 'word'); select json_insert('{"a":1, "b":{"c":1}, "d":[1, 2]}', '$.b.k1', 'word');
json_insert('{"a":1, "b":{"c":1}, "d":[1, 2]}', '$.b.k1', 'word') json_insert('{"a":1, "b":{"c":1}, "d":[1, 2]}', '$.b.k1', 'word')
{"a":1, "b":{"c":1, "k1":"word"}, "d":[1, 2]} {"a":1, "b":{"c":1, "k1":"word"}, "d":[1, 2]}

1
mysql-test/t/func_json.test
View File

@ -41,6 +41,7 @@ select json_extract('{"key1":"asd", "key2":[2,3]}', "$.keyX", "$.keyY");
select json_extract('{"key1":"asd", "key2":[2,3]}', "$.key1", "$.key2"); select json_extract('{"key1":"asd", "key2":[2,3]}', "$.key1", "$.key2");
select json_extract('{"key1":5, "key2":[2,3]}', "$.key1", "$.key2"); select json_extract('{"key1":5, "key2":[2,3]}', "$.key1", "$.key2");
select json_extract('{"key0":true, "key1":"qwe"}', "$.key1"); select json_extract('{"key0":true, "key1":"qwe"}', "$.key1");
select json_extract(json_object('foo', 'foobar'),'$');
select json_insert('{"a":1, "b":{"c":1}, "d":[1, 2]}', '$.b.k1', 'word'); select json_insert('{"a":1, "b":{"c":1}, "d":[1, 2]}', '$.b.k1', 'word');
select json_insert('{"a":1, "b":{"c":1}, "d":[1, 2]}', '$.d[3]', 3); select json_insert('{"a":1, "b":{"c":1}, "d":[1, 2]}', '$.d[3]', 3);

13
sql/item_jsonfunc.cc
View File

@ -427,8 +427,8 @@ String *Item_func_json_extract::val_str(String *str)
json_engine_t je; json_engine_t je;
bool multiple_values_found= FALSE; bool multiple_values_found= FALSE;
const uchar *value; const uchar *value;
const char *first_value= NULL, *first_p_value; const char *first_value= NULL;
uint n_arg, v_len, first_len, first_p_len; uint n_arg, v_len, first_len;
uint array_counters[JSON_DEPTH_LIMIT]; uint array_counters[JSON_DEPTH_LIMIT];
if ((null_value= args[0]->null_value)) if ((null_value= args[0]->null_value))
@ -487,13 +487,6 @@ String *Item_func_json_extract::val_str(String *str)
*/ */
first_value= (const char *) value; first_value= (const char *) value;
first_len= v_len; first_len= v_len;
/*
We need this as we have to preserve quotes around string
constants if we use the value to create an array. Otherwise
we get the value without the quotes.
*/
first_p_value= (const char *) je.value;
first_p_len= je.value_len;
continue; continue;
} }
else else
@ -519,7 +512,7 @@ String *Item_func_json_extract::val_str(String *str)
if (multiple_values_found ? if (multiple_values_found ?
str->append("]") : str->append("]") :
str->append(first_p_value, first_p_len)) str->append(first_value, first_len))
goto error; /* Out of memory. */ goto error; /* Out of memory. */
return str; return str;