NotificationsYou must be signed in to change notification settings
Fork6
Star31

Commit6d10f4e

committed

Only adjust negative indexes in json_get up to the length of the path.

The previous code resulted in memory access beyond the path bounds. Thecure is to move it into a code branch that checks the value of lex_levelis within the correct bounds.Bug reported and diagnosed by Piotr Stefaniak.

1 parentd8f15c9 commit6d10f4eCopy full SHA for 6d10f4e

File tree

1 file changed

+13

-13

lines changed

src/backend/utils/adt
- jsonfuncs.c

1 file changed

+13

-13

lines changed

`‎src/backend/utils/adt/jsonfuncs.c`

Lines changed: 13 additions & 13 deletions

Original file line number	Diff line number	Diff line change
`@@ -977,27 +977,27 @@ get_array_start(void *state)`
`977`	`977`	`{`
`978`	`978`	`/* Initialize counting of elements in this array */`
`979`	`979`	`_state->array_cur_index[lex_level]=-1;`
	`980`	`+`
	`981`	`+/* INT_MIN value is reserved to represent invalid subscript */`
	`982`	`+if (_state->path_indexes[lex_level]<0&&`
	`983`	`+_state->path_indexes[lex_level]!=INT_MIN)`
	`984`	`+{`
	`985`	`+/* Negative subscript -- convert to positive-wise subscript */`
	`986`	`+intnelements=json_count_array_elements(_state->lex);`
	`987`	`+`
	`988`	`+if (-_state->path_indexes[lex_level] <=nelements)`
	`989`	`+_state->path_indexes[lex_level]+=nelements;`
	`990`	`+}`
`980`	`991`	`}`
`981`	`992`	`elseif (lex_level==0&&_state->npath==0)`
`982`	`993`	`{`
`983`	`994`	`/*`
`984`	`995`	`* Special case: we should match the entire array. We only need this`
`985`		`- * at outermost level because at nested levels the match will have`
`986`		`- * been started by the outer field or array element callback.`
	`996`	`+ * attheoutermost level because at nested levels the match will`
	`997`	`+ *havebeen started by the outer field or array element callback.`
`987`	`998`	`*/`
`988`	`999`	`_state->result_start=_state->lex->token_start;`
`989`	`1000`	`}`
`990`		`-`
`991`		`-/* INT_MIN value is reserved to represent invalid subscript */`
`992`		`-if (_state->path_indexes[lex_level]<0&&`
`993`		`-_state->path_indexes[lex_level]!=INT_MIN)`
`994`		`-{`
`995`		`-/* Negative subscript -- convert to positive-wise subscript */`
`996`		`-intnelements=json_count_array_elements(_state->lex);`
`997`		`-`
`998`		`-if (-_state->path_indexes[lex_level] <=nelements)`
`999`		`-_state->path_indexes[lex_level]+=nelements;`
`1000`		`-}`
`1001`	`1001`	`}`
`1002`	`1002`
`1003`	`1003`	`staticvoid`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commit6d10f4e

File tree

1 file changed

1 file changed

`‎src/backend/utils/adt/jsonfuncs.c`

0 commit comments