diff options
| author | Rucha Deodhar <rucha.deodhar@mariadb.com> | 2022-04-18 15:31:36 +0530 |
|---|---|---|
| committer | Rucha Deodhar <rucha.deodhar@mariadb.com> | 2022-04-26 12:37:11 +0530 |
| commit | 3716eaff4e2fd0be15c076e15de690a7b61559a6 (patch) | |
| tree | c6b228c679d16b2f1e95769e42120d5741ca8dec /mysql-test | |
| parent | 375b8f40ce1bb7e93bcb87145c3c00fa0fa5d87e (diff) | |
| download | mariadb-git-3716eaff4e2fd0be15c076e15de690a7b61559a6.tar.gz | |
MDEV-28326: Server crashes in json_path_parts_compare
Analysis: When trying to compare json paths, the array_sizes variable is
NULL when beginning. But trying to access address by adding to the NULL
pointer while recursive calling json_path_parts_compare() for handling
double wildcard, it causes undefined behaviour and the array_sizes
variable eventually becomes non-null (has some address).
This eventually results in crash.
Fix: If array_sizes variable is NULL then pass NULL recursively as well.
Diffstat (limited to 'mysql-test')
| -rw-r--r-- | mysql-test/main/func_json.result | 6 | ||||
| -rw-r--r-- | mysql-test/main/func_json.test | 7 |
2 files changed, 13 insertions, 0 deletions
diff --git a/mysql-test/main/func_json.result b/mysql-test/main/func_json.result index 0bb5441b393..ffdda37684e 100644 --- a/mysql-test/main/func_json.result +++ b/mysql-test/main/func_json.result @@ -2278,5 +2278,11 @@ SELECT JSON_EXISTS(@json, '$[2][2][1 to 4]'); JSON_EXISTS(@json, '$[2][2][1 to 4]') 1 # +# MDEV-28326: Server crashes in json_path_parts_compare +# +SELECT * FROM JSON_TABLE('{"foo":["bar","qux"]}','$**.*[0]' COLUMNS(col1 CHAR(8) PATH '$[0]')) AS jt; +col1 +bar +# # End of 10.9 Test # diff --git a/mysql-test/main/func_json.test b/mysql-test/main/func_json.test index 71f9c192237..91d5002acc8 100644 --- a/mysql-test/main/func_json.test +++ b/mysql-test/main/func_json.test @@ -1526,6 +1526,13 @@ SELECT JSON_EXISTS(@json, '$[2][2][1 to 2]'); SELECT JSON_EXISTS(@json, '$[2][2][4 to 6]'); SELECT JSON_EXISTS(@json, '$[2][2][1 to 4]'); + +--echo # +--echo # MDEV-28326: Server crashes in json_path_parts_compare +--echo # + +SELECT * FROM JSON_TABLE('{"foo":["bar","qux"]}','$**.*[0]' COLUMNS(col1 CHAR(8) PATH '$[0]')) AS jt; + --echo # --echo # End of 10.9 Test --echo # |