mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-01-29 02:05:57 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

MDEV-31147 json_normalize does not work correctly with MSAN build

Browse source 
json_normalize_number(): Avoid accessing str past str_len.
The function would seem to work incorrectly when some digits are
not followed by a decimal point (.) or an exponent (E or e).
This commit is contained in:
Marko Mäkelä 2023-04-28 12:15:45 +03:00
parent 5028b7c7c8
commit 7d967423fe
3 changed files with 36 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
mysql-test/main/func_json.result
View file

@ -1673,3 +1673,16 @@ DROP TABLE t;
#
# End of 10.6 tests
#
#
# MDEV-31147 json_normalize does not work correctly with MSAN build
#
CREATE TABLE t1 (val JSON);
ALTER TABLE t1 ADD COLUMN normalized_json JSON AS (JSON_NORMALIZE(val));
INSERT INTO t1 (val) VALUES ('15');
SELECT * FROM t1;
val normalized_json
15 1.5E1
DROP TABLE t1;
#
# End of 10.8 tests
#

13
mysql-test/main/func_json.test
View file

@ -1112,3 +1112,16 @@ DROP TABLE t;
--echo #
--echo # End of 10.6 tests
--echo #
--echo #
--echo # MDEV-31147 json_normalize does not work correctly with MSAN build
--echo #
CREATE TABLE t1 (val JSON);
ALTER TABLE t1 ADD COLUMN normalized_json JSON AS (JSON_NORMALIZE(val));
INSERT INTO t1 (val) VALUES ('15');
SELECT * FROM t1;
DROP TABLE t1;
--echo #
--echo # End of 10.8 tests
--echo #

17
strings/json_normalize.c
View file

@ -147,13 +147,16 @@ json_normalize_number(DYNAMIC_STRING *out, const char *str, size_t str_len)
magnitude = (long)(j - 1);
/* skip the . */
if (str[i] == '.')
++i;
if (i < str_len)
{
/* skip the . */
if (str[i] == '.')
++i;
/* grab rest of digits before the E */
for (; i < str_len && str[i] != 'e' && str[i] != 'E'; ++i)
buf[j++] = str[i];
/* grab rest of digits before the E */
for (; i < str_len && str[i] != 'e' && str[i] != 'E'; ++i)
buf[j++] = str[i];
}
/* trim trailing zeros */
for (k = j - 1; k && buf[k] == '0'; --k, --j)
@ -187,7 +190,7 @@ json_normalize_number(DYNAMIC_STRING *out, const char *str, size_t str_len)
err|= dynstr_append_mem(out, STRING_WITH_LEN("E"));
if (str[i] == 'e' || str[i] == 'E')
if (i < str_len && (str[i] == 'e' || str[i] == 'E'))
{
char *endptr = NULL;
/* skip the [eE] */