mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-01-29 02:05:57 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

MDEV-13971 crash in skip_num_constant.

Browse source 
Character bigger than 0x60 wasn't handled properly
        inside a numeric constant.
This commit is contained in:
Alexey Botchkov 2017-11-11 13:54:56 +04:00
parent dcbf2823c7
commit 1e2d4f677e
3 changed files with 8 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
mysql-test/r/func_json.result
View file

@ -725,3 +725,6 @@ json_contains_path('{"foo":"bar"}', 'one', '$[]')
NULL
Warnings:
Warning 4042 Syntax error in JSON path in argument 3 to function 'json_contains_path' at position 3
select JSON_VALID(0x36f0c8dccd83c5eac156da);
JSON_VALID(0x36f0c8dccd83c5eac156da)
0

4
mysql-test/t/func_json.test
View file

@ -378,3 +378,7 @@ SELECT JSON_OBJECT("user","Jožko Mrkvičká") as json_data;
select json_contains_path('{"foo":"bar"}', 'one', '$[]');
#
# MDEV-13971 crash in skip_num_constant.
#
select JSON_VALID(0x36f0c8dccd83c5eac156da);

2
strings/json_lib.c
View file

@ -503,7 +503,7 @@ static int skip_num_constant(json_engine_t *j)
for (;;)
{
j->num_flags|= json_num_state_flags[state];
if ((c_len= json_next_char(&j->s)) > 0)
if ((c_len= json_next_char(&j->s)) > 0 && j->s.c_next < 128)
{
if ((state= json_num_states[state][json_num_chr_map[j->s.c_next]]) > 0)
{