NotificationsYou must be signed in to change notification settings
Fork5
Star27

Commit40a50a1

committed

Only adjust negative indexes in json_get up to the length of the path.

The previous code resulted in memory access beyond the path bounds. Thecure is to move it into a code branch that checks the value of lex_levelis within the correct bounds.Bug reported and diagnosed by Piotr Stefaniak.

1 parent116be6c commit40a50a1Copy full SHA for 40a50a1

File tree

1 file changed

+13

-13

lines changed

src/backend/utils/adt
- jsonfuncs.c

1 file changed

+13

-13

lines changed

`‎src/backend/utils/adt/jsonfuncs.c‎`

Lines changed: 13 additions & 13 deletions

Original file line number	Diff line number	Diff line change
`@@ -977,27 +977,27 @@ get_array_start(void *state)`
`977`	`977`	`{`
`978`	`978`	`/* Initialize counting of elements in this array */`
`979`	`979`	`_state->array_cur_index[lex_level]=-1;`
	`980`	`+`
	`981`	`+/* INT_MIN value is reserved to represent invalid subscript */`
	`982`	`+if (_state->path_indexes[lex_level]<0&&`
	`983`	`+_state->path_indexes[lex_level]!=INT_MIN)`
	`984`	`+{`
	`985`	`+/* Negative subscript -- convert to positive-wise subscript */`
	`986`	`+intnelements=json_count_array_elements(_state->lex);`
	`987`	`+`
	`988`	`+if (-_state->path_indexes[lex_level] <=nelements)`
	`989`	`+_state->path_indexes[lex_level]+=nelements;`
	`990`	`+}`
`980`	`991`	`}`
`981`	`992`	`elseif (lex_level==0&&_state->npath==0)`
`982`	`993`	`{`
`983`	`994`	`/*`
`984`	`995`	`* Special case: we should match the entire array. We only need this`
`985`		`- * at outermost level because at nested levels the match will have`
`986`		`- * been started by the outer field or array element callback.`
	`996`	`+ * attheoutermost level because at nested levels the match will`
	`997`	`+ *havebeen started by the outer field or array element callback.`
`987`	`998`	`*/`
`988`	`999`	`_state->result_start=_state->lex->token_start;`
`989`	`1000`	`}`
`990`		`-`
`991`		`-/* INT_MIN value is reserved to represent invalid subscript */`
`992`		`-if (_state->path_indexes[lex_level]<0&&`
`993`		`-_state->path_indexes[lex_level]!=INT_MIN)`
`994`		`-{`
`995`		`-/* Negative subscript -- convert to positive-wise subscript */`
`996`		`-intnelements=json_count_array_elements(_state->lex);`
`997`		`-`
`998`		`-if (-_state->path_indexes[lex_level] <=nelements)`
`999`		`-_state->path_indexes[lex_level]+=nelements;`
`1000`		`-}`
`1001`	`1001`	`}`
`1002`	`1002`
`1003`	`1003`	`staticvoid`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commit40a50a1

File tree

1 file changed

1 file changed

`‎src/backend/utils/adt/jsonfuncs.c‎`

0 commit comments