From 03e00d6b84ab636c25093daddb2fb255998882cd Mon Sep 17 00:00:00 2001
From: drh <>
Date: Sun, 11 Oct 2026 23:06:04 +0000
Subject: [PATCH] Do not allow the json_valid() routine to use a cached (and
 possibly edited) copy of the JSON.  It needs to parse the JSON for itself.
 [bugs:/info/2026-10-11T18:32:23Z|Bug 2026-10-11T18:32:23Z].

FossilOrigin-Name: ba74c33b6a69f8eeca3f8c497f9f74dd6dc92bfe8f4b0dcf0325595a5664c9d9
---
 manifest          | 14 +++++++-------
 manifest.uuid     |  2 +-
 src/json.c        |  7 +++++--
 test/json102.test | 31 +++++++++++++++++++++++++++++++
 4 files changed, 44 insertions(+), 10 deletions(-)

diff --git a/manifest b/manifest
index 07e04e0828..c31613ac12 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Another\sfix\sto\sthe\sorder-by-subquery\soptimization\nof\scheck-in\s[7a0cdc7edb704a88].\sTrouble\sreported\sby\n[bugs:/info/2026-10-11T17:00:56Z|Bug\s2026-10-11T17:00:56Z].
-D 2026-10-11T18:38:57.052
+C Do\snot\sallow\sthe\sjson_valid()\sroutine\sto\suse\sa\scached\s(and\spossibly\sedited)\ncopy\sof\sthe\sJSON.\s\sIt\sneeds\sto\sparse\sthe\sJSON\sfor\sitself.\n[bugs:/info/2026-10-11T18:32:23Z|Bug\s2026-10-11T18:32:23Z].
+D 2026-10-11T23:06:04.905
 F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
@@ -762,7 +762,7 @@ F src/hash.h 46b92795a95bfefb210f52f0c316e9d7cdbcdd7e7fcfb0d8be796d3a5767cddf
 F src/hwtime.h 5cb15147c8583d0fc4748e1c12ea6f38c9deaeefa147a4d8d379fd9bc81fee9a
 F src/in-operator.md 10cd8f4bcd225a32518407c2fb2484089112fd71
 F src/insert.c 482d853c980f4765f045bbea3ab095067a52cd57f47e357f9f17aa7c7fff793f
-F src/json.c 98b654f8316e76bdff4eaf915ba6b95335a8b77e0bcd650a107c7ac86fb16080
+F src/json.c c3ba268dda607a377f210dcf84603bb3d282f9833c8aa0abfb0c8951aefc40be
 F src/legacy.c d7874bc885906868cd51e6c2156698f2754f02d9eee1bae2d687323c3ca8e5aa
 F src/loadext.c 5cd4cd7ec6e1a46416806899086363fbf95eecd3bfb9a388b436c9a77243c902
 F src/main.c a32bcae6e3bfd9209d922b02c28ba796fa628322c3c4be0c5a76c418be793d13
@@ -1434,7 +1434,7 @@ F test/json/json-q1.txt 65f9d1cdcc4cffa9823fb73ed936aae5658700cd001fde448f68bfb9
 F test/json/json-speed-check.sh 45862b216f1f8bbf16d74e2ad6ea20c773ee77774b299a7e0f76a22eb98e91f1 x
 F test/json/jsonb-q1.txt 1e180fe6491efab307e318b22879e3a736ac9a96539bbde7911a13ee5b33abc7
 F test/json101.test 9911cb0a2a337987350bd206cabc6626e94677a791d4905177fffe9bae91c7d4
-F test/json102.test ea5c9811e408e115c8fc539548deef431fda4924c23cacd79dd4b783f4449f07
+F test/json102.test 3bb040081909b2fc11b65426ccacf3f9cc918c321181d7d0482abcdce577adcb
 F test/json103.test e626d109cd0bdb8282ec9bf755af3befa50e3e03a255362fc53433d31e1d66d4
 F test/json104.test 1b844a70cddcfa2e4cd81a5db0657b2e61e7f00868310f24f56a9ba0114348c1
 F test/json105.test 9900caa21888289873bc6c14f5ee41213d28ac9b7ca3395f8afb73d540e80f66
@@ -2283,8 +2283,8 @@ F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee
 F tool/warnings.sh a554d13f6e5cf3760f041b87939e3d616ec6961859c3245e8ef701d1eafc2ca2
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
 F tool/winmain.c 00c8fb88e365c9017db14c73d3c78af62194d9644feaf60e220ab0f411f3604c
-P e6e27e37eb8c3159d67529959694971f35a589da75648e207c44e317e6d160be
-R d95406870443382222b8acbab92f9f0f
+P 1b574df8c7df4f737ca7b7e42203a8090836a05bc808cafc8f8f70aefbe8627b
+R 15bfa453b61557bf8898ba3ceda6a928
 U drh
-Z 645d94f02c859d7750556ce47d6ed593
+Z 26f42b6d7df7cf53583d450754c77161
 # Remove this line to create a well-formed Fossil manifest.
diff --git a/manifest.uuid b/manifest.uuid
index f61e9c1bff..da329710c0 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-1b574df8c7df4f737ca7b7e42203a8090836a05bc808cafc8f8f70aefbe8627b
+ba74c33b6a69f8eeca3f8c497f9f74dd6dc92bfe8f4b0dcf0325595a5664c9d9
diff --git a/src/json.c b/src/json.c
index 3a3a14d9d2..e5d9830a3c 100644
--- a/src/json.c
+++ b/src/json.c
@@ -398,6 +398,7 @@ struct JsonParse {
 */
 #define JSON_EDITABLE  0x01   /* Generate a writable JsonParse object */
 #define JSON_KEEPERROR 0x02   /* Return non-NULL even if there is an error */
+#define JSON_NOCACHE   0x04   /* Do not use the JSON cache */
 
 /**************************************************************************
 ** Forward references
@@ -3841,7 +3842,9 @@ static JsonParse *jsonParseFuncArg(
   if( eType==SQLITE_NULL ){
     return 0;
   }
-  pFromCache = jsonCacheSearch(ctx, pArg);
+  if( (flgs & JSON_NOCACHE)==0 ){
+    pFromCache = jsonCacheSearch(ctx, pArg);
+  }
   if( pFromCache ){
     pFromCache->nJPRef++;
     if( (flgs & JSON_EDITABLE)==0 ){
@@ -4916,7 +4919,7 @@ static void jsonValidFunc(
       if( (flags & 0x3)==0 ) break;
       memset(&px, 0, sizeof(px));
      
-      p = jsonParseFuncArg(ctx, argv[0], JSON_KEEPERROR);
+      p = jsonParseFuncArg(ctx, argv[0], JSON_KEEPERROR|JSON_NOCACHE);
       if( p ){
         if( p->oom ){
           sqlite3_result_error_nomem(ctx);
diff --git a/test/json102.test b/test/json102.test
index 54f66a83f0..404bc7a084 100644
--- a/test/json102.test
+++ b/test/json102.test
@@ -839,5 +839,36 @@ do_execsql_test json102-1831 {
   SELECT '["zero","one","two"]'->1;
 } {{"one"}}
 
+# Bug 2026-10-11T18:32:23Z
+#
+do_execsql_test json102-1900 {
+  SELECT json_set('[0x1F]', '$[1]', 2),
+         json_valid(json_set('[0x1F]', '$[1]', 2));
+} {{[31,2]} 1}
+do_execsql_test json102-1900 {
+  SELECT typeof(jsonb_set('[0x1F]', '$[1]', 2)),
+         json_valid(jsonb_set('[0x1F]', '$[1]', 2),6);
+} {blob 1}
+do_execsql_test json102-1910 {
+  SELECT json_set('[0x1F]', '$[1]', 2),
+         json_valid(' '||json_set('[0x1F]', '$[1]', 2));
+} {{[31,2]} 1}
+do_execsql_test json102-1920 {
+  SELECT json_set('[0x1F]', '$[1]', 2),
+         json_valid('[31,2]');
+} {{[31,2]} 1}
+do_execsql_test json102-1930 {
+  SELECT json_valid('[31,2]'),
+         json_set('[0x1F]', '$[1]', 2);
+} {1 {[31,2]}}
+do_execsql_test json102-1940 {
+  SELECT json_valid(json_set('{k:1}','$.v', printf('%.*c',120,'x')));
+} {1}
+do_execsql_test json102-1940 {
+  SELECT json_valid(jsonb_set('{k:1}','$.v', printf('%.*c',120,'x')),6);
+} {1}
+do_execsql_test json102-1950 {
+  SELECT json_valid(json_set('{k:1}','$.v', printf('%.*c',120,'x'))||' ');
+} {1}
 
 finish_test