diff options
| author | Sergei Golubchik <serg@mariadb.org> | 2023-01-20 19:21:17 +0100 |
|---|---|---|
| committer | Sergei Golubchik <serg@mariadb.org> | 2023-01-20 19:43:15 +0100 |
| commit | 0c275599944cc8aa073d3b3bea550aebdf207d00 (patch) | |
| tree | 6d7a832081118198652651ae3c6115fbd3a38834 | |
| parent | fc292f42be1ad767c6346eb9bca8e057911bca92 (diff) | |
| download | mariadb-git-0c275599944cc8aa073d3b3bea550aebdf207d00.tar.gz | |
MDEV-26817 runtime error: index 24320 out of bounds for type 'json_string_char_classes [128] *and* ASAN: global-buffer-overflow on address ... READ of size 4 on SELECT JSON_VALID
protect from out-of-bound array access
it was already done in all other places, this one was the only one missed
| -rw-r--r-- | strings/json_lib.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/strings/json_lib.c b/strings/json_lib.c index 1b9adfff117..5c7747617e9 100644 --- a/strings/json_lib.c +++ b/strings/json_lib.c @@ -826,7 +826,7 @@ static int skip_key(json_engine_t *j) { int t_next, c_len; - if (json_instr_chr_map[j->s.c_next] == S_BKSL && + if (j->s.c_next<128 && json_instr_chr_map[j->s.c_next] == S_BKSL && json_handle_esc(&j->s)) return 1; |