Skip to content

Commit e7a927b

Browse files
committed
MDEV-38264: Fix failed assertion in json_find_path with trailing commas
The function json_skip_array_and_count() was trapping syntax errors (e.g., trailing commas) in a local engine copy. Because the error state wasn't propagated back to the main engine, json_find_path() would proceed with an inconsistent state, eventually triggering an assertion failure. This patch ensures that any error encountered during the lookahead scan is propagated to the primary engine. This allows the parser to fail gracefully with a syntax error instead of crashing.
1 parent 1855454 commit e7a927b

3 files changed

Lines changed: 42 additions & 1 deletion

File tree

mysql-test/main/func_json.result

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2771,3 +2771,27 @@ SELECT JSON_VALUE('{"a":[1,2]}', '$.a[*]');
27712771
JSON_VALUE('{"a":[1,2]}', '$.a[*]')
27722772
NULL
27732773
# End of 10.11 Test
2774+
#
2775+
# MDEV-38264 Assertion in json_find_path() fails after computing
2776+
# array size of invalid json structure
2777+
#
2778+
SELECT JSON_QUERY('{ "A": [0,] }', '$.A[-1]');
2779+
JSON_QUERY('{ "A": [0,] }', '$.A[-1]')
2780+
NULL
2781+
SELECT JSON_VALUE('{ "A": [0,] }', '$.A[-1]');
2782+
JSON_VALUE('{ "A": [0,] }', '$.A[-1]')
2783+
NULL
2784+
SELECT JSON_VALUE('{ "A": [5,] }', '$.A[-2]');
2785+
JSON_VALUE('{ "A": [5,] }', '$.A[-2]')
2786+
NULL
2787+
SELECT JSON_VALUE('{ "A": [5] }', '$.A[-2]');
2788+
JSON_VALUE('{ "A": [5] }', '$.A[-2]')
2789+
NULL
2790+
SELECT JSON_LENGTH('{ "A": [0,] }', '$.A');
2791+
JSON_LENGTH('{ "A": [0,] }', '$.A')
2792+
NULL
2793+
Warnings:
2794+
Warning 4038 Syntax error in JSON text in argument 1 to function 'json_length' at position 11
2795+
SELECT JSON_VALID('{ "A": [0,] }');
2796+
JSON_VALID('{ "A": [0,] }')
2797+
0

mysql-test/main/func_json.test

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2033,3 +2033,16 @@ COLUMNS(NAME VARCHAR(30) PATH '$.NAME')) AS t_sz;
20332033
SELECT JSON_VALUE('{"a":[1,2]}', '$.a[*]');
20342034

20352035
--echo # End of 10.11 Test
2036+
2037+
--echo #
2038+
--echo # MDEV-38264 Assertion in json_find_path() fails after computing
2039+
--echo # array size of invalid json structure
2040+
--echo #
2041+
2042+
SELECT JSON_QUERY('{ "A": [0,] }', '$.A[-1]');
2043+
SELECT JSON_VALUE('{ "A": [0,] }', '$.A[-1]');
2044+
SELECT JSON_VALUE('{ "A": [5,] }', '$.A[-2]');
2045+
SELECT JSON_VALUE('{ "A": [5] }', '$.A[-2]');
2046+
SELECT JSON_LENGTH('{ "A": [0,] }', '$.A');
2047+
SELECT JSON_VALID('{ "A": [0,] }');
2048+

strings/json_lib.c

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1306,9 +1306,13 @@ int json_skip_level_and_count(json_engine_t *j, int *n_items_skipped)
13061306
int json_skip_array_and_count(json_engine_t *je, int *n_items)
13071307
{
13081308
json_engine_t j= *je;
1309+
int res;
13091310
*n_items= 0;
13101311

1311-
return json_skip_level_and_count(&j, n_items);
1312+
res= json_skip_level_and_count(&j, n_items);
1313+
if (res)
1314+
je->s.error= j.s.error;
1315+
return res;
13121316
}
13131317

13141318

0 commit comments

Comments
 (0)