Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-41521

json_lib: inconsistent OOM handling during parser initialisation

    XMLWordPrintable

Details

    • Bug
    • Status: Open (View Workflow)
    • Minor
    • Resolution: Unresolved
    • 10.6(EOL), 10.11, 11.4, 11.8, 12.3, 13.0
    • 10.11, 13.0
    • JSON
    • None

    Description

      A common pattern in JSON SQL functions is to call mem_root_dynamic_array_init() with init_buffer = NULL and init_alloc = JSON_DEPTH_DEFAULT, followed by json_scan_start().

      The former considers the array usable even if allocation fails and returns success with je.stack.buffer == NULL. However, json_scan_start() unconditionally writes to that buffer: *((int*)(je->stack.buffer))= val.

      An allocation failure can therefore cause a NULL pointer dereference instead of a graceful error.

      The same issue affects the mem_root_dynamic_array_init() + json_path_setup() combination.

      Another problem is memset(array->buffer, 0, array->size_of_element*array->max_element), which is practically equivalent to memset(NULL, 0, 0).

      Attachments

        Activity

          People

            Unassigned Unassigned
            svoj Sergey Vojtovich
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.