MDEV-11143 Server crashes in json_string_set_cs.

        Some JSON functions didn't expect NULL as a path.

1 files changed, 15 insertions, 0 deletions

diff --git a/sql/item_jsonfunc.cc b/sql/item_jsonfunc.cc
index 42ad5470965..c22881620ff 100644
--- a/sql/item_jsonfunc.cc
+++ b/sql/item_jsonfunc.cc
@@ -450,6 +450,9 @@ String *Item_func_json_extract::val_str(String *str)
       c_path->parsed= c_path->constant;
     }
 
+    if (args[n_arg]->null_value)
+      goto error;
+
     json_scan_start(&je, js->charset(),(const uchar *) js->ptr(),
                     (const uchar *) js->ptr() + js->length());
 
@@ -547,6 +550,9 @@ longlong Item_func_json_extract::val_int()
       c_path->parsed= c_path->constant;
     }
 
+    if (args[n_arg]->null_value)
+      goto error;
+
     json_scan_start(&je, js->charset(),(const uchar *) js->ptr(),
                     (const uchar *) js->ptr() + js->length());
 
@@ -661,6 +667,9 @@ longlong Item_func_json_contains::val_int()
       c_path->parsed= c_path->constant;
     }
 
+    if (args[n_arg]->null_value)
+      goto error;
+
     json_scan_start(&je, js->charset(),(const uchar *) js->ptr(),
                     (const uchar *) js->ptr() + js->length());
 
@@ -768,6 +777,9 @@ longlong Item_func_json_contains_path::val_int()
       c_path->parsed= c_path->constant;
     }
 
+    if (args[n_arg]->null_value)
+      goto error;
+
     json_scan_start(&je, js->charset(),(const uchar *) js->ptr(),
                     (const uchar *) js->ptr() + js->length());
 
@@ -1946,6 +1958,9 @@ String *Item_func_json_search::val_str(String *str)
     }
   }
 
+  if (args[n_arg]->null_value)
+    goto null_return;
+
   json_scan_start(&je, js->charset(),(const uchar *) js->ptr(),
                   (const uchar *) js->ptr() + js->length());