database/postgres
database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-05-03 22:24:49 +03:00
Code

Only adjust negative indexes in json_get up to the length of the path.

Browse Source 
The previous code resulted in memory access beyond the path bounds. The
cure is to move it into a code branch that checks the value of lex_level
is within the correct bounds.

Bug reported and diagnosed by Piotr Stefaniak.
This commit is contained in:
Andrew Dunstan 2015-07-28 17:54:13 -04:00
parent 116be6c171
commit 40a50a17b9
1 changed files with 13 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
src/backend/utils/adt/jsonfuncs.c
View File

@ -977,27 +977,27 @@ get_array_start(void *state)
{ {
/* Initialize counting of elements in this array */ /* Initialize counting of elements in this array */
_state->array_cur_index[lex_level] = -1; _state->array_cur_index[lex_level] = -1;
/* INT_MIN value is reserved to represent invalid subscript */
if (_state->path_indexes[lex_level] < 0 &&
_state->path_indexes[lex_level] != INT_MIN)
{
/* Negative subscript -- convert to positive-wise subscript */
int nelements = json_count_array_elements(_state->lex);
if (-_state->path_indexes[lex_level] <= nelements)
_state->path_indexes[lex_level] += nelements;
}
} }
else if (lex_level == 0 && _state->npath == 0) else if (lex_level == 0 && _state->npath == 0)
{ {
/* /*
* Special case: we should match the entire array. We only need this * Special case: we should match the entire array. We only need this
* at outermost level because at nested levels the match will have * at the outermost level because at nested levels the match will
* been started by the outer field or array element callback. * have been started by the outer field or array element callback.
*/ */
_state->result_start = _state->lex->token_start; _state->result_start = _state->lex->token_start;
} }
/* INT_MIN value is reserved to represent invalid subscript */
if (_state->path_indexes[lex_level] < 0 &&
_state->path_indexes[lex_level] != INT_MIN)
{
/* Negative subscript -- convert to positive-wise subscript */
int nelements = json_count_array_elements(_state->lex);
if (-_state->path_indexes[lex_level] <= nelements)
_state->path_indexes[lex_level] += nelements;
}
} }
static void static void