diff options
| author | Alexey Botchkov <holyfoot@askmonty.org> | 2017-11-11 13:54:56 +0400 |
|---|---|---|
| committer | Alexey Botchkov <holyfoot@askmonty.org> | 2017-11-11 13:54:56 +0400 |
| commit | 1e2d4f677e08294691a7d218acb3b9f78727ae18 (patch) | |
| tree | 5e2fae3484f831e371225ae406b699041bd62b7c | |
| parent | dcbf2823c7d64380f06372d77d1522e97fb8f066 (diff) | |
| download | mariadb-git-1e2d4f677e08294691a7d218acb3b9f78727ae18.tar.gz | |
MDEV-13971 crash in skip_num_constant.
Character bigger than 0x60 wasn't handled properly
inside a numeric constant.
| -rw-r--r-- | mysql-test/r/func_json.result | 3 | ||||
| -rw-r--r-- | mysql-test/t/func_json.test | 4 | ||||
| -rw-r--r-- | strings/json_lib.c | 2 |
3 files changed, 8 insertions, 1 deletions
diff --git a/mysql-test/r/func_json.result b/mysql-test/r/func_json.result index dc27062bc27..041030f4aab 100644 --- a/mysql-test/r/func_json.result +++ b/mysql-test/r/func_json.result @@ -725,3 +725,6 @@ json_contains_path('{"foo":"bar"}', 'one', '$[]') NULL Warnings: Warning 4042 Syntax error in JSON path in argument 3 to function 'json_contains_path' at position 3 +select JSON_VALID(0x36f0c8dccd83c5eac156da); +JSON_VALID(0x36f0c8dccd83c5eac156da) +0 diff --git a/mysql-test/t/func_json.test b/mysql-test/t/func_json.test index 2b865360b51..2052fad0c04 100644 --- a/mysql-test/t/func_json.test +++ b/mysql-test/t/func_json.test @@ -378,3 +378,7 @@ SELECT JSON_OBJECT("user","Jožko Mrkvičká") as json_data; select json_contains_path('{"foo":"bar"}', 'one', '$[]'); +# +# MDEV-13971 crash in skip_num_constant. +# +select JSON_VALID(0x36f0c8dccd83c5eac156da); diff --git a/strings/json_lib.c b/strings/json_lib.c index cf99afd6f7b..413ce128149 100644 --- a/strings/json_lib.c +++ b/strings/json_lib.c @@ -503,7 +503,7 @@ static int skip_num_constant(json_engine_t *j) for (;;) { j->num_flags|= json_num_state_flags[state]; - if ((c_len= json_next_char(&j->s)) > 0) + if ((c_len= json_next_char(&j->s)) > 0 && j->s.c_next < 128) { if ((state= json_num_states[state][json_num_chr_map[j->s.c_next]]) > 0) { |