MDEV-37640: Crash at String::append in json_normalize#4728
MDEV-37640: Crash at String::append in json_normalize#4728abhishek593 wants to merge 1 commit intoMariaDB:10.11from
Conversation
grooverdan
added
the
External Contribution
|
Does this happen to resolve MDEV-33984 too? If so its test case could be included too. |
|
@grooverdan The fix is the same, but instead in Item_func_json_keys::val_str. I was thinking to open another PR since the fix version for that is 10.6. Should I change that in this PR itself? |
Great
It is a bit anomalous that one crash as a fix version of 10.6 and the other 10.11. As its so close, can you just push the MDEV-33984 fix onto this branch and leave as 10.11 for now. It means there's one less merge conflict in tests and since the problems are so similar it easier to review if both are in memory at the same time. Thanks @abhishek593. Great seeing your work to correct all these old JSON bugs. |
This also fixes MDEV-33984. Item_func_json_normalize::val_str() and Item_func_json_keys::val_str failed to initialize the character set of the result buffer. In certain contexts, the buffer can be a zero-initialized String object with a NULL charset. This led to a null pointer dereference in String::append(), which relies on the charset information. Fixed by explicitly setting the buffer's charset to the item's collation before appending the normalized JSON string.
|
@grooverdan Thanks for the kind words. I've updated the PR to also include the fix for MDEV-33984. |
3 participants
Item_func_json_normalize::val_str() failed to initialize the character set of the result buffer. In certain contexts, the buffer can be a zero-initialized String object with a NULL charset. This led to a null pointer dereference in String::append(), which relies on the charset information.
Fixed by explicitly setting the buffer's charset to the item's collation before appending the normalized JSON string.