Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-40971

JSON Path Array Index 32-bit Integer Truncation Wraparound ( [ 2 3 2 + n ] ≡ [2 3 2+n]≡[n])

    XMLWordPrintable

Details

    Description

      If an array index in a JSON path exceeds the 32-bit range, MariaDB truncates it as unsigned 32-bit (mod 2^32) and continues the lookup, so $[4294967297] effectively equals $[1], $[8589934592] (2^33) equals $[0], and the negative index $[-4294967295] wraps to $[1] — queries that should return NULL for an out-of-range index instead return data from the wrong position. MySQL raises an error for such paths (Invalid JSON path expression).

      SELECT '[10,20]'->'$[4294967296]'; – 10 (=2^32, wraps to $[0]; should be NULL)
      SELECT '[10,20]'->'$[4294967297]'; – 20 (=2^32+1, wraps to $[1]; should be NULL)
      SELECT '[10,20]'->'$[4294967298]'; – NULL(=2^32+2, wraps to $[2], out of range -> NULL)
      SELECT '[10,20]'->'$[8589934592]'; – 10 (=2^33, wraps to $[0]; should be NULL)
      SELECT '[10,20]'->'$[-4294967295]'; – 20 (negative wraps: -4294967295+2^32 = 1)
      SELECT JSON_EXTRACT('[10,20]','$[4294967297]'); – 20 (direct call reproduces too; not -> specific)

      Attachments

        Issue Links

          Activity

            People

              rucha174 Rucha Deodhar
              chunlingqin chunlingqin
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.