Fix an error in the inversion function for json_group_array().

dbsqlfuzz 68a4b0f668b7bc27235e3f1c5cff8a2d94cfa17e.

FossilOrigin-Name: e718a62ed1d5ba9b1404ba67fae1ad731809e2ebd9253edc57d2b34a19fbef24

diff --git a/ext/misc/json1.c b/ext/misc/json1.c
index 77641064d441ebad32682a92512953380e2e7666..5863cffbc211efc84c7233b29b27ccbd04b79595 100644 (file)
--- a/ext/misc/json1.c
+++ b/ext/misc/json1.c
@@ -1959,11 +1959,7 @@ static void jsonGroupInverse(
   if( NEVER(!pStr) ) return;
 #endif
   z = pStr->zBuf;
-  for(i=1; (c = z[i])!=',' || inStr || nNest; i++){
-    if( i>=pStr->nUsed ){
-      pStr->nUsed = 1;
-      return;
-    }
+  for(i=1; i<pStr->nUsed && ((c = z[i])!=',' || inStr || nNest); i++){
     if( c=='"' ){
       inStr = !inStr;
     }else if( c=='\\' ){
@@ -1973,8 +1969,13 @@ static void jsonGroupInverse(
       if( c=='}' || c==']' ) nNest--;
     }
   }
-  pStr->nUsed -= i;      
-  memmove(&z[1], &z[i+1], (size_t)pStr->nUsed-1);
+  if( i<pStr->nUsed ){
+    pStr->nUsed -= i;
+    memmove(&z[1], &z[i+1], (size_t)pStr->nUsed-1);
+    z[pStr->nUsed] = 0;
+  }else{
+    pStr->nUsed = 1;
+  }
 }
 #else
 # define jsonGroupInverse 0

diff --git a/manifest b/manifest
index 6d79037b7bdaa98868a52646992712d4dd8930bd..e3c55868e30842e3218380c67ddcfed6cd6b7659 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Fix\sa\sfaulty\sassert()\sinside\ssqlite3ExprDup().
-D 2021-04-12T23:18:18.464
+C Fix\san\serror\sin\sthe\sinversion\sfunction\sfor\sjson_group_array().\ndbsqlfuzz\s68a4b0f668b7bc27235e3f1c5cff8a2d94cfa17e.
+D 2021-04-13T01:12:32.327
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -305,7 +305,7 @@ F ext/misc/fileio.c 9b69e25da3b51d4a1d905a464ccb96709792ad627a742ba09215bc0d1447
 F ext/misc/fossildelta.c 1240b2d3e52eab1d50c160c7fe1902a9bd210e052dc209200a750bbf885402d5
 F ext/misc/fuzzer.c eae560134f66333e9e1ca4c8ffea75df42056e2ce8456734565dbe1c2a92bf3d
 F ext/misc/ieee754.c cd6ab89f85fda8a020559b3f4d03001a8a62dd856beda5af3f558621d12be913
-F ext/misc/json1.c f31e89171f932d1821c91f10d2cb4979fc0447030030a8bce70420cd43d074c0
+F ext/misc/json1.c 2e3a947cd142b5d4b6e67ccb58b54190b0e78a9dd2d5fdfc9a55fa9060662624
 F ext/misc/memstat.c 3017a0832c645c0f8c773435620d663855f04690172316bd127270d1a7523d4d
 F ext/misc/memtrace.c 7c0d115d2ef716ad0ba632c91e05bd119cb16c1aedf3bec9f06196ead2d5537b
 F ext/misc/memvfs.c ab36f49e02ebcdf85a1e08dc4d8599ea8f343e073ac9e0bca18a98b7e1ec9567
@@ -1912,7 +1912,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 79b883537910274518cadbda7b5088811f59287b9385fc28ab54d837d41b995a
-R ce35e0dc6c3e4fcedd0f6901688d0ba8
+P 59812e7ef705226c801f95ec7f78cc931f9957ffb66715607d63874813b280cb
+R dcc689ed7d4561f53e31e7e91d60e325
 U drh
-Z 9a3b39088d3d1f8f04556da71936b8ab
+Z 19d9f22d241b7563d9e432472de6d324

diff --git a/manifest.uuid b/manifest.uuid
index fc2b83ac805012482c7201e7816224e3577a24bc..c06d90a6b25e8259039cba63114dd3a645993b1f 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-59812e7ef705226c801f95ec7f78cc931f9957ffb66715607d63874813b280cb
\ No newline at end of file
+e718a62ed1d5ba9b1404ba67fae1ad731809e2ebd9253edc57d2b34a19fbef24
\ No newline at end of file