Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitb574228

Browse files
committed
Add tests for json{b}_populate_recordset() crash case.
The problem reported asCVE-2017-15098 was already resolved in HEAD bycommit37a795a, but let's add the relevant test cases anyway.Michael Paquier and Tom Lane, per a report from David Rowley.Security:CVE-2017-15098
1 parentdfc015d commitb574228

File tree

4 files changed

+38
-0
lines changed

4 files changed

+38
-0
lines changed

‎src/test/regress/expected/json.out

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1857,6 +1857,19 @@ SELECT json_populate_recordset(row(1,2)::j_ordered_pair, '[{"x": 0}, {"y": 3}]')
18571857

18581858
SELECT json_populate_recordset(row(1,2)::j_ordered_pair, '[{"x": 1, "y": 0}]');
18591859
ERROR: value for domain j_ordered_pair violates check constraint "j_ordered_pair_check"
1860+
-- negative cases where the wrong record type is supplied
1861+
select * from json_populate_recordset(row(0::int),'[{"a":"1","b":"2"},{"a":"3"}]') q (a text, b text);
1862+
ERROR: function return row and query-specified return row do not match
1863+
DETAIL: Returned row contains 1 attribute, but query expects 2.
1864+
select * from json_populate_recordset(row(0::int,0::int),'[{"a":"1","b":"2"},{"a":"3"}]') q (a text, b text);
1865+
ERROR: function return row and query-specified return row do not match
1866+
DETAIL: Returned type integer at ordinal position 1, but query expects text.
1867+
select * from json_populate_recordset(row(0::int,0::int,0::int),'[{"a":"1","b":"2"},{"a":"3"}]') q (a text, b text);
1868+
ERROR: function return row and query-specified return row do not match
1869+
DETAIL: Returned row contains 3 attributes, but query expects 2.
1870+
select * from json_populate_recordset(row(1000000000::int,50::int),'[{"b":"2"},{"a":"3"}]') q (a text, b text);
1871+
ERROR: function return row and query-specified return row do not match
1872+
DETAIL: Returned type integer at ordinal position 1, but query expects text.
18601873
-- test type info caching in json_populate_record()
18611874
CREATE TEMP TABLE jspoptest (js json);
18621875
INSERT INTO jspoptest

‎src/test/regress/expected/jsonb.out

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2539,6 +2539,19 @@ SELECT jsonb_populate_recordset(row(1,2)::jb_ordered_pair, '[{"x": 0}, {"y": 3}]
25392539

25402540
SELECT jsonb_populate_recordset(row(1,2)::jb_ordered_pair, '[{"x": 1, "y": 0}]');
25412541
ERROR: value for domain jb_ordered_pair violates check constraint "jb_ordered_pair_check"
2542+
-- negative cases where the wrong record type is supplied
2543+
select * from jsonb_populate_recordset(row(0::int),'[{"a":"1","b":"2"},{"a":"3"}]') q (a text, b text);
2544+
ERROR: function return row and query-specified return row do not match
2545+
DETAIL: Returned row contains 1 attribute, but query expects 2.
2546+
select * from jsonb_populate_recordset(row(0::int,0::int),'[{"a":"1","b":"2"},{"a":"3"}]') q (a text, b text);
2547+
ERROR: function return row and query-specified return row do not match
2548+
DETAIL: Returned type integer at ordinal position 1, but query expects text.
2549+
select * from jsonb_populate_recordset(row(0::int,0::int,0::int),'[{"a":"1","b":"2"},{"a":"3"}]') q (a text, b text);
2550+
ERROR: function return row and query-specified return row do not match
2551+
DETAIL: Returned row contains 3 attributes, but query expects 2.
2552+
select * from jsonb_populate_recordset(row(1000000000::int,50::int),'[{"b":"2"},{"a":"3"}]') q (a text, b text);
2553+
ERROR: function return row and query-specified return row do not match
2554+
DETAIL: Returned type integer at ordinal position 1, but query expects text.
25422555
-- jsonb_to_record and jsonb_to_recordset
25432556
select * from jsonb_to_record('{"a":1,"b":"foo","c":"bar"}')
25442557
as x(a int, b text, d text);

‎src/test/regress/sql/json.sql

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -553,6 +553,12 @@ SELECT json_populate_recordset(null::j_ordered_pair, '[{"x": 0, "y": 1}]');
553553
SELECT json_populate_recordset(row(1,2)::j_ordered_pair,'[{"x": 0}, {"y": 3}]');
554554
SELECT json_populate_recordset(row(1,2)::j_ordered_pair,'[{"x": 1, "y": 0}]');
555555

556+
-- negative cases where the wrong record type is supplied
557+
select*from json_populate_recordset(row(0::int),'[{"a":"1","b":"2"},{"a":"3"}]') q (atext, btext);
558+
select*from json_populate_recordset(row(0::int,0::int),'[{"a":"1","b":"2"},{"a":"3"}]') q (atext, btext);
559+
select*from json_populate_recordset(row(0::int,0::int,0::int),'[{"a":"1","b":"2"},{"a":"3"}]') q (atext, btext);
560+
select*from json_populate_recordset(row(1000000000::int,50::int),'[{"b":"2"},{"a":"3"}]') q (atext, btext);
561+
556562
-- test type info caching in json_populate_record()
557563
CREATE TEMP TABLE jspoptest (js json);
558564

‎src/test/regress/sql/jsonb.sql

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -669,6 +669,12 @@ SELECT jsonb_populate_recordset(null::jb_ordered_pair, '[{"x": 0, "y": 1}]');
669669
SELECT jsonb_populate_recordset(row(1,2)::jb_ordered_pair,'[{"x": 0}, {"y": 3}]');
670670
SELECT jsonb_populate_recordset(row(1,2)::jb_ordered_pair,'[{"x": 1, "y": 0}]');
671671

672+
-- negative cases where the wrong record type is supplied
673+
select*from jsonb_populate_recordset(row(0::int),'[{"a":"1","b":"2"},{"a":"3"}]') q (atext, btext);
674+
select*from jsonb_populate_recordset(row(0::int,0::int),'[{"a":"1","b":"2"},{"a":"3"}]') q (atext, btext);
675+
select*from jsonb_populate_recordset(row(0::int,0::int,0::int),'[{"a":"1","b":"2"},{"a":"3"}]') q (atext, btext);
676+
select*from jsonb_populate_recordset(row(1000000000::int,50::int),'[{"b":"2"},{"a":"3"}]') q (atext, btext);
677+
672678
-- jsonb_to_record and jsonb_to_recordset
673679

674680
select*from jsonb_to_record('{"a":1,"b":"foo","c":"bar"}')

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp