Details
-
Bug
-
Status: Open (View Workflow)
-
Minor
-
Resolution: Unresolved
-
10.6(EOL), 10.11, 11.4, 11.8, 12.3, 13.0
-
None
Description
A common pattern in JSON SQL functions is to call mem_root_dynamic_array_init() with init_buffer = NULL and init_alloc = JSON_DEPTH_DEFAULT, followed by json_scan_start().
The former considers the array usable even if allocation fails and returns success with je.stack.buffer == NULL. However, json_scan_start() unconditionally writes to that buffer: *((int*)(je->stack.buffer))= val.
An allocation failure can therefore cause a NULL pointer dereference instead of a graceful error.
The same issue affects the mem_root_dynamic_array_init() + json_path_setup() combination.
Another problem is memset(array->buffer, 0, array->size_of_element*array->max_element), which is practically equivalent to memset(NULL, 0, 0).