database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-29 05:21:33 +03:00
Code Activity

MDEV-33015: Server crashes upon JSON_SCHEMA_VALID reading NULL from a user

Browse Source 
variable

Analysis:
Since the item is NULL, it's json value is NULL but we proceed to parse
it anyway.
Fix:
If json value is NULL, return NULL.
This commit is contained in:
Rucha Deodhar
2023-12-15 16:06:24 +05:30
parent 187cbfca7c
commit fa2e1c3948
3 changed files with 24 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
mysql-test/main/func_json.result
View File

@ -4737,4 +4737,11 @@ NULL
# #
PREPARE s FROM 'SELECT JSON_SCHEMA_VALID (?,''{}'') FROM DUAL'; PREPARE s FROM 'SELECT JSON_SCHEMA_VALID (?,''{}'') FROM DUAL';
ERROR HY000: Variable schema is not supported. ERROR HY000: Variable schema is not supported.
#
# MDEV-33015: Server crashes upon JSON_SCHEMA_VALID reading NULL from a user variable
#
SET @a= NULL;
SELECT JSON_SCHEMA_VALID(@a,'{}');
JSON_SCHEMA_VALID(@a,'{}')
NULL
# End of 11.1 test # End of 11.1 test

8
mysql-test/main/func_json.test
View File

@ -3708,4 +3708,12 @@ SELECT JSON_SCHEMA_VALID(NULL, NULL);
--error ER_JSON_NO_VARIABLE_SCHEMA --error ER_JSON_NO_VARIABLE_SCHEMA
PREPARE s FROM 'SELECT JSON_SCHEMA_VALID (?,''{}'') FROM DUAL'; PREPARE s FROM 'SELECT JSON_SCHEMA_VALID (?,''{}'') FROM DUAL';
--echo #
--echo # MDEV-33015: Server crashes upon JSON_SCHEMA_VALID reading NULL from a user variable
--echo #
SET @a= NULL;
SELECT JSON_SCHEMA_VALID(@a,'{}');
--echo # End of 11.1 test --echo # End of 11.1 test

14
sql/item_jsonfunc.cc
View File

@ -4809,17 +4809,21 @@ bool Item_func_json_schema_valid::fix_length_and_dec(THD *thd)
String *js= NULL; String *js= NULL;
if (!is_schema_constant || (null_value= args[0]->null_value)) if (!is_schema_constant)
{ {
if (!is_schema_constant)
{ my_error(ER_JSON_NO_VARIABLE_SCHEMA, MYF(0));
my_error(ER_JSON_NO_VARIABLE_SCHEMA, MYF(0));
}
null_value= 1; null_value= 1;
return 0; return 0;
} }
null_value= args[0]->null_value;
js= args[0]->val_json(&tmp_js); js= args[0]->val_json(&tmp_js);
if (!js)
{
null_value= 1;
return 0;
}
json_scan_start(&je, js->charset(), (const uchar *) js->ptr(), json_scan_start(&je, js->charset(), (const uchar *) js->ptr(),
(const uchar *) js->ptr() + js->length()); (const uchar *) js->ptr() + js->length());
if (!create_object_and_handle_keyword(thd, &je, &keyword_list, if (!create_object_and_handle_keyword(thd, &je, &keyword_list,