Fix the use of an uninitialized value that occurs when doing a json_insert()

of a string value that contains embedded U+0000 characters.

FossilOrigin-Name: d3c0cbb90966316be9cd25e3edb501da42731e8a83c13227b90ce17d3975a2c3

diff --git a/manifest b/manifest
index 560c66a99545e56e88202666b335e2ca274840b8..0368f0f70b02c813b7e7593d02e893299b1a2c10 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Add\s(prepare,\sstep,\sreset,\sfinalize)\sparts\sof\sthe\sJNI\slevel-2\sstmt\swrapper\sand\sassociated\stests.
-D 2023-10-11T13:52:05.849
+C Fix\sthe\suse\sof\san\suninitialized\svalue\sthat\soccurs\swhen\sdoing\sa\sjson_insert()\nof\sa\sstring\svalue\sthat\scontains\sembedded\sU+0000\scharacters.
+D 2023-10-11T17:24:31.588
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -674,7 +674,7 @@ F src/hash.h 3340ab6e1d13e725571d7cee6d3e3135f0779a7d8e76a9ce0a85971fa3953c51
 F src/hwtime.h f9c2dfb84dce7acf95ce6d289e46f5f9d3d1afd328e53da8f8e9008e3b3caae6
 F src/in-operator.md 10cd8f4bcd225a32518407c2fb2484089112fd71
 F src/insert.c 3f0a94082d978bbdd33c38fefea15346c6c6bffb70bc645a71dc0f1f87dd3276
-F src/json.c 82b9cef53ebc00069d516a06be4aa971e2e70caffe3417bd6001bf00177bb1bf
+F src/json.c 799430345d16fed21713416318e6ca616f1264224f708555f387bfa2ab2496c7
 F src/legacy.c d7874bc885906868cd51e6c2156698f2754f02d9eee1bae2d687323c3ca8e5aa
 F src/loadext.c 98cfba10989b3da6f1807ad42444017742db7f100a54f1032af7a8b1295912c0
 F src/main.c 618aeb399e993cf561864f4b0cf6a331ee4f355cf663635f8d9da3193a46aa40
@@ -1306,7 +1306,7 @@ F test/json/README.md 63e3e589e1df8fd3cc1588ba1faaff659214003f8b77a15af5c6452b35
 F test/json/json-generator.tcl dc0dd0f393800c98658fc4c47eaa6af29d4e17527380cd28656fb261bddc8a3f
 F test/json/json-q1.txt 65f9d1cdcc4cffa9823fb73ed936aae5658700cd001fde448f68bfb91c807307
 F test/json/json-speed-check.sh 8b7babf530faa58bd59d6d362cec8e9036a68c5457ff46f3b1f1511d21af6737 x
-F test/json101.test 4d78048b185ffb9ae37645fa6934d48fc182473ae0bae088a1e2f7ba483c3a71
+F test/json101.test 1ad070e5616dee76bffbe9724e6add16ab7ad506d5af9e606627b163baf1a7b4
 F test/json102.test 4c69694773a470f1fda34e5f4ba24920b35184fb66050b450fc2ef9ab5ad310b
 F test/json103.test 53df87f83a4e5fa0c0a56eb29ff6c94055c6eb919f33316d62161a8880112dbe
 F test/json104.test 1b844a70cddcfa2e4cd81a5db0657b2e61e7f00868310f24f56a9ba0114348c1
@@ -2128,8 +2128,9 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 793bbfa5af9721bc3a61e8e5eda46dfce2f5ff3f223a7564c9e1b09f11e53cb3
-R 4d3cf5230b57585fb263b4c0d4fb2b1e
-U stephan
-Z 39c6ded9773037a11fc3746bbfb10c12
+P a7082f186f2b9b6666bbc65f2eadeb74d91fa0a681e3b2468b261ffd322bd249
+Q +fc5ee9e51ad4556af526a6cefca5ae5a3b1b7affc4edf09832491d6b4f4ba366
+R 93737f5b55ab3449be7057400ec68be2
+U drh
+Z 222827e9ae2110e3474e6249138dc8a5
 # Remove this line to create a well-formed Fossil manifest.

diff --git a/manifest.uuid b/manifest.uuid
index 7b40a7c4e7781697ce575fd5ff8637157e942009..36f21eb5987762a3d6c57f3888a8b57a5d9a23dd 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-a7082f186f2b9b6666bbc65f2eadeb74d91fa0a681e3b2468b261ffd322bd249
\ No newline at end of file
+d3c0cbb90966316be9cd25e3edb501da42731e8a83c13227b90ce17d3975a2c3
\ No newline at end of file

diff --git a/src/json.c b/src/json.c
index b28ba7ecdc4ba24833ba7fe3d9d9a66408215ae1..e334b22140d0472813e363c353ad4aac036e95bd 100644 (file)
--- a/src/json.c
+++ b/src/json.c
@@ -2843,11 +2843,13 @@ static void jsonReplaceNode(
          break;
       }
       if( sqlite3_value_subtype(pValue)!=JSON_SUBTYPE ){
-        char *zCopy = sqlite3DbStrDup(0, z);
+        char *zCopy = sqlite3_malloc64( n+1 );
         int k;
         if( zCopy ){
+          memcpy(zCopy, z, n);
+          zCopy[n] = 0;
           jsonParseAddCleanup(p, sqlite3_free, zCopy);
-       }else{
+        }else{
           p->oom = 1;
           sqlite3_result_error_nomem(pCtx);
         }

diff --git a/test/json101.test b/test/json101.test
index 45903307400aaad33b4e9723d94a93b2a9489e58..d734dbb0e1612d2c98fe1df01a4c0ecae327c519 100644 (file)
--- a/test/json101.test
+++ b/test/json101.test
@@ -119,6 +119,9 @@ do_execsql_test json101-4.7 {
 do_execsql_test json101-4.8 {
   SELECT x FROM j1 WHERE json_insert(x)<>x;
 } {}
+do_execsql_test json101-4.9 {
+  SELECT json_insert('{"a":1}','$.b',CAST(x'0000' AS text));
+} {{{"a":1,"b":"\u0000\u0000"}}}
 
 # json_extract(JSON,'$') will return objects and arrays without change.
 #