Fix the use of an uninitialized value that occurs when doing a json_insert()

of a string value that contains embedded U+0000 characters.

FossilOrigin-Name: 7dcd9cfedc521d34bd41f7d1c045f2c70916c10655044667f87bb9b0b4a3fcf3

diff --git a/manifest b/manifest
index a3fe73c220c4f18467d6b6cfa80e5247930cc089..8419826d0e160ebf47964f27a9b7738a0e9bfb86 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Fix\sa\sbug\sin\sthe\smkautoconfamal.sh\sscript\nso\sthat\sthe\s"snapshot-tarball"\sand\s"amalgamation-tarball"\smakefile\stargets\nwork\sagain\swhen\srun\sfrom\soutside\sof\sthe\ssource\stree.
-D 2023-10-10T15:34:17.824
+C Fix\sthe\suse\sof\san\suninitialized\svalue\sthat\soccurs\swhen\sdoing\sa\sjson_insert()\nof\sa\sstring\svalue\sthat\scontains\sembedded\sU+0000\scharacters.
+D 2023-10-11T17:34:50.922
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -644,7 +644,7 @@ F src/hash.h 3340ab6e1d13e725571d7cee6d3e3135f0779a7d8e76a9ce0a85971fa3953c51
 F src/hwtime.h f9c2dfb84dce7acf95ce6d289e46f5f9d3d1afd328e53da8f8e9008e3b3caae6
 F src/in-operator.md 10cd8f4bcd225a32518407c2fb2484089112fd71
 F src/insert.c 3f0a94082d978bbdd33c38fefea15346c6c6bffb70bc645a71dc0f1f87dd3276
-F src/json.c 5c25f82e1c0f3eb44fb9a23feff6b7b952fd40122d9e3ab601a84ea83710a980
+F src/json.c dcccb1617b217587c7381db557e06b10cdcd2a0438a572ef7ac3435bea40a83c
 F src/legacy.c d7874bc885906868cd51e6c2156698f2754f02d9eee1bae2d687323c3ca8e5aa
 F src/loadext.c 98cfba10989b3da6f1807ad42444017742db7f100a54f1032af7a8b1295912c0
 F src/main.c fde8f13c876a658b4e8b74b77d875ca887915c174ea6a2f3122d80966f93d865
@@ -1273,7 +1273,7 @@ F test/json/README.md 63e3e589e1df8fd3cc1588ba1faaff659214003f8b77a15af5c6452b35
 F test/json/json-generator.tcl dc0dd0f393800c98658fc4c47eaa6af29d4e17527380cd28656fb261bddc8a3f
 F test/json/json-q1.txt 65f9d1cdcc4cffa9823fb73ed936aae5658700cd001fde448f68bfb91c807307
 F test/json/json-speed-check.sh 8b7babf530faa58bd59d6d362cec8e9036a68c5457ff46f3b1f1511d21af6737 x
-F test/json101.test 4d78048b185ffb9ae37645fa6934d48fc182473ae0bae088a1e2f7ba483c3a71
+F test/json101.test 1ad070e5616dee76bffbe9724e6add16ab7ad506d5af9e606627b163baf1a7b4
 F test/json102.test 4c69694773a470f1fda34e5f4ba24920b35184fb66050b450fc2ef9ab5ad310b
 F test/json103.test 53df87f83a4e5fa0c0a56eb29ff6c94055c6eb919f33316d62161a8880112dbe
 F test/json104.test 1b844a70cddcfa2e4cd81a5db0657b2e61e7f00868310f24f56a9ba0114348c1
@@ -2093,9 +2093,9 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 4310099cce5a487035fa535dd3002c59ac7f1d1bec68d7cf317fd3e769484790
-Q +65ccf5fef812d43aed9e00af36c90e1a499d197e30148753790445e25ee1324c
-R c9c0a04075c9b32c5c361001c4315d93
+P 3a79cf25e3df516c3ab3faab3085a87385df30d29d4bdd0e72b3607243887fd3
+Q +d3c0cbb90966316be9cd25e3edb501da42731e8a83c13227b90ce17d3975a2c3
+R dbb86c23946123428beaf025b32bda45
 U drh
-Z 4a14c303310ac27c4c9cc6aa5451cc27
+Z 0b291023bd7147d5dfbf7e9621736a02
 # Remove this line to create a well-formed Fossil manifest.

diff --git a/manifest.uuid b/manifest.uuid
index 4accd63fc40dfd316bbf770b9a6356fc9f90ec24..0ecd91b78c8596ef02f90cef7635fb41597db8bc 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-3a79cf25e3df516c3ab3faab3085a87385df30d29d4bdd0e72b3607243887fd3
\ No newline at end of file
+7dcd9cfedc521d34bd41f7d1c045f2c70916c10655044667f87bb9b0b4a3fcf3
\ No newline at end of file

diff --git a/src/json.c b/src/json.c
index 2e81948e76501d1d99121840e1f39cd071d1591b..fa3163928bde40b088035b4a27cd5c68cc3ffd07 100644 (file)
--- a/src/json.c
+++ b/src/json.c
@@ -2843,11 +2843,13 @@ static void jsonReplaceNode(
          break;
       }
       if( sqlite3_value_subtype(pValue)!=JSON_SUBTYPE ){
-        char *zCopy = sqlite3DbStrDup(0, z);
+        char *zCopy = sqlite3_malloc64( n+1 );
         int k;
         if( zCopy ){
+          memcpy(zCopy, z, n);
+          zCopy[n] = 0;
           jsonParseAddCleanup(p, sqlite3_free, zCopy);
-       }else{
+        }else{
           p->oom = 1;
           sqlite3_result_error_nomem(pCtx);
         }

diff --git a/test/json101.test b/test/json101.test
index 45903307400aaad33b4e9723d94a93b2a9489e58..d734dbb0e1612d2c98fe1df01a4c0ecae327c519 100644 (file)
--- a/test/json101.test
+++ b/test/json101.test
@@ -119,6 +119,9 @@ do_execsql_test json101-4.7 {
 do_execsql_test json101-4.8 {
   SELECT x FROM j1 WHERE json_insert(x)<>x;
 } {}
+do_execsql_test json101-4.9 {
+  SELECT json_insert('{"a":1}','$.b',CAST(x'0000' AS text));
+} {{{"a":1,"b":"\u0000\u0000"}}}
 
 # json_extract(JSON,'$') will return objects and arrays without change.
 #