Details
-
Bug
-
Status: Confirmed (View Workflow)
-
Major
-
Resolution: Unresolved
-
10.11, 11.4, 11.8, 12.3, 13.0, 13.1
Description
If an array index in a JSON path exceeds the 32-bit range, MariaDB truncates it as unsigned 32-bit (mod 2^32) and continues the lookup, so $[4294967297] effectively equals $[1], $[8589934592] (2^33) equals $[0], and the negative index $[-4294967295] wraps to $[1] — queries that should return NULL for an out-of-range index instead return data from the wrong position. MySQL raises an error for such paths (Invalid JSON path expression).
SELECT '[10,20]'->'$[4294967296]'; – 10 (=2^32, wraps to $[0]; should be NULL)
SELECT '[10,20]'->'$[4294967297]'; – 20 (=2^32+1, wraps to $[1]; should be NULL)
SELECT '[10,20]'->'$[4294967298]'; – NULL(=2^32+2, wraps to $[2], out of range -> NULL)
SELECT '[10,20]'->'$[8589934592]'; – 10 (=2^33, wraps to $[0]; should be NULL)
SELECT '[10,20]'->'$[-4294967295]'; – 20 (negative wraps: -4294967295+2^32 = 1)
SELECT JSON_EXTRACT('[10,20]','$[4294967297]'); – 20 (direct call reproduces too; not -> specific)
Attachments
Issue Links
- is duplicated by
-
MDEV-40987 PERIOD_ADD increment argument 32-bit wraparound
-
- Closed
-
- relates to
-
MDEV-40986 JSON edit functions' array-index 32-bit wraparound (edit variant of M4 — modifies the wrong position)
-
- Confirmed
-