Details
-
Bug
-
Status: Open (View Workflow)
-
Major
-
Resolution: Unresolved
-
11.8.8
-
None
Description
BJSON::GetString doesn't validate paramters and crashes if a NULL value was passed.
How to repeat:
1. copy employee.dat from source tree into server directory.
2. SQL:
CREATE FUNCTION bson_array_grp
|
RETURNS STRING
|
SONAME 'ha_connect.so';
|
|
|
CREATE FUNCTION bson_make_object
|
RETURNS STRING
|
SONAME 'ha_connect.so';
|
|
|
CREATE FUNCTION bsonvalue
|
RETURNS STRING SONAME 'ha_connect.so';
|
|
|
CREATE FUNCTION bson_get_item
|
RETURNS STRING SONAME 'ha_connect.so';
|
|
|
CREATE FUNCTION bsonget_string
|
RETURNS STRING SONAME 'ha_connect.so';
|
|
|
CREATE FUNCTION bsonget_int
|
RETURNS INTEGER SONAME 'ha_connect.so';
|
|
|
CREATE FUNCTION bsonget_real
|
RETURNS REAL SONAME 'ha_connect.so';
|
|
|
CREATE FUNCTION bson_test
|
RETURNS INTEGER SONAME 'ha_connect.so';
|
|
|
CREATE TABLE t3 (
|
SERIALNO CHAR(5) NOT NULL,
|
NAME VARCHAR(12) NOT NULL FLAG=6,
|
SEX SMALLINT(1) NOT NULL,
|
TITLE VARCHAR(15) NOT NULL FLAG=20,
|
MANAGER CHAR(5) DEFAULT NULL,
|
DEPARTMENT CHAr(4) NOT NULL FLAG=41,
|
|
|
SECRETARY CHAR(5) DEFAULT NULL FLAG=46,
|
SALARY DOUBLE(8,2) NOT NULL FLAG=52
|
) ENGINE=CONNECT CHARSET=latin1 TABLE_TYPE=FIX BLOCK_SIZE=8 FILE_NAME='employee.dat' ENDING=1;
|
|
|
# Add a comma before "Json_salaries" (typo)
|
SELECT department, BsonGet_Int(Bson_Make_Object(department, Bson_Array_Grp(salary), "Json_salaries"), 'salaries.[+]') Sumsal FROM t3 GROUP BY department
|
|
|
ERROR 2013 (HY000): Lost connection to server during query
|
|