database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-30 16:24:05 +03:00
Code Activity

MDEV-13970 crash in Item_func_json_extract::read_json.

Browse Source 
Item_func_json_extract::val_int fixed.
        It wasn't tested yet as it's called in exotic cases only.
This commit is contained in:
Alexey Botchkov
2017-12-25 08:10:48 +04:00
parent 6e7ca6b0b2
commit f0f3b6549a
3 changed files with 17 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
mysql-test/r/func_json.result
View File

@ -731,3 +731,8 @@ Warning 4042 Syntax error in JSON path in argument 3 to function 'json_contains_
select JSON_VALID(0x36f0c8dccd83c5eac156da); select JSON_VALID(0x36f0c8dccd83c5eac156da);
JSON_VALID(0x36f0c8dccd83c5eac156da) JSON_VALID(0x36f0c8dccd83c5eac156da)
0 0
create table t1(a double not null);
insert into t1 values (2),(1);
select 1 from t1 where json_extract(a,'$','$[81]');
1
drop table t1;

9
mysql-test/t/func_json.test
View File

@ -383,3 +383,12 @@ select json_contains_path('{"foo":"bar"}', 'one', '$[]');
# MDEV-13971 crash in skip_num_constant. # MDEV-13971 crash in skip_num_constant.
# #
select JSON_VALID(0x36f0c8dccd83c5eac156da); select JSON_VALID(0x36f0c8dccd83c5eac156da);
#
# MDEV-13970 crash in Item_func_json_extract::read_json.
#
create table t1(a double not null);
insert into t1 values (2),(1);
select 1 from t1 where json_extract(a,'$','$[81]');
drop table t1;

6
sql/item_jsonfunc.cc
View File

@ -781,10 +781,10 @@ String *Item_func_json_extract::read_json(String *str,
{ {
str->set_charset(js->charset()); str->set_charset(js->charset());
str->length(0); str->length(0);
}
if (possible_multiple_values && str->append("[", 1)) if (possible_multiple_values && str->append("[", 1))
goto error; goto error;
}
json_get_path_start(&je, js->charset(),(const uchar *) js->ptr(), json_get_path_start(&je, js->charset(),(const uchar *) js->ptr(),
(const uchar *) js->ptr() + js->length(), &p); (const uchar *) js->ptr() + js->length(), &p);