From: drh <>
Date: Thu, 7 Dec 2023 12:55:39 +0000 (+0000)
Subject: Improved detection of corrupt JSONB in the jsonReturnFromBlob() function.
X-Git-Tag: version-3.45.0~107
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5b6b7034615f009923fe46ee6f1fcebf23c66fdd;p=thirdparty%2Fsqlite.git

Improved detection of corrupt JSONB in the jsonReturnFromBlob() function.

FossilOrigin-Name: b014736c1f80ccc46fb4b24ac04310a6ce5cb5b6653665efff366cb3bc742257
---

diff --git a/manifest b/manifest
index 10b2d5cbfd..2175694e92 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Fix\scompiler\swarning\sabout\sshadowed\svariable\sin\sfts5_index.c.
-D 2023-12-06T18:34:59.649
+C Improved\sdetection\sof\scorrupt\sJSONB\sin\sthe\sjsonReturnFromBlob()\sfunction.
+D 2023-12-07T12:55:39.473
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -696,7 +696,7 @@ F src/hash.h 3340ab6e1d13e725571d7cee6d3e3135f0779a7d8e76a9ce0a85971fa3953c51
 F src/hwtime.h f9c2dfb84dce7acf95ce6d289e46f5f9d3d1afd328e53da8f8e9008e3b3caae6
 F src/in-operator.md 10cd8f4bcd225a32518407c2fb2484089112fd71
 F src/insert.c 3f0a94082d978bbdd33c38fefea15346c6c6bffb70bc645a71dc0f1f87dd3276
-F src/json.c c2e0fea06f40fb0319ed132fc181a25623585c943e08c690b522f216886ba316
+F src/json.c 674cabf943f30d735c8ffd50e4ae1b4e3ccb52fd7cddae4c556ebcf7f410f0c8
 F src/legacy.c d7874bc885906868cd51e6c2156698f2754f02d9eee1bae2d687323c3ca8e5aa
 F src/loadext.c 7432c944ff197046d67a1207790a1b13eec4548c85a9457eb0896bb3641dfb36
 F src/main.c 1b89f3de98d1b59fec5bac1d66d6ece21f703821b8eaa0d53d9604c35309f6f9
@@ -2153,8 +2153,8 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P ec0ae4030968c782af48d1c776351c14b2ada21d40aeb97915f33df30706e18f
-R edfe66d6aa99b5210c61e8b6b973888d
-U dan
-Z 66c944797bd4988ebf2844c99b4718ad
+P ee70e4c1c9c41617850228e48d8df44f105cf2fbbe789340ceca6f27ad6ce5eb
+R 00cfbe2052391ca2d7a17dea6eb84d8b
+U drh
+Z f70f3172c97aeaef0feb684dd3865d25
 # Remove this line to create a well-formed Fossil manifest.
diff --git a/manifest.uuid b/manifest.uuid
index 414f169a76..0629939106 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-ee70e4c1c9c41617850228e48d8df44f105cf2fbbe789340ceca6f27ad6ce5eb
\ No newline at end of file
+b014736c1f80ccc46fb4b24ac04310a6ce5cb5b6653665efff366cb3bc742257
\ No newline at end of file
diff --git a/src/json.c b/src/json.c
index 46d7a3fa8c..850e2241e6 100644
--- a/src/json.c
+++ b/src/json.c
@@ -2618,14 +2618,17 @@ static void jsonReturnFromBlob(
   }
   switch( pParse->aBlob[i] & 0x0f ){
     case JSONB_NULL: {
+      if( sz ) goto returnfromblob_malformed;
       sqlite3_result_null(pCtx);
       break;
     }
     case JSONB_TRUE: {
+      if( sz ) goto returnfromblob_malformed;
       sqlite3_result_int(pCtx, 1);
       break;
     }
     case JSONB_FALSE: {
+      if( sz ) goto returnfromblob_malformed;
       sqlite3_result_int(pCtx, 0);
       break;
     }
@@ -2634,16 +2637,25 @@ static void jsonReturnFromBlob(
       sqlite3_int64 iRes = 0;
       char *z;
       int bNeg = 0;
-      char x = (char)pParse->aBlob[i+n];
-      if( x=='-' && ALWAYS(sz>0) ){ n++; sz--; bNeg = 1; }
+      char x;
+      if( sz==0 ) goto returnfromblob_malformed;
+      x = (char)pParse->aBlob[i+n];
+      if( x=='-' ){
+        if( sz<2 ) goto returnfromblob_malformed;
+        n++;
+        sz--;
+        bNeg = 1;
+      }
       z = sqlite3DbStrNDup(db, (const char*)&pParse->aBlob[i+n], (int)sz);
-      if( z==0 ) return;
+      if( z==0 ) goto returnfromblob_oom;
       rc = sqlite3DecOrHexToI64(z, &iRes);
       sqlite3DbFree(db, z);
-      if( rc<=1 ){
+      if( rc==0 ){
         sqlite3_result_int64(pCtx, bNeg ? -iRes : iRes);
       }else if( rc==3 && bNeg ){
         sqlite3_result_int64(pCtx, SMALLEST_INT64);
+      }else if( rc==1 ){
+        goto returnfromblob_malformed;
       }else{
         if( bNeg ){ n--; sz++; }
         goto to_double;
@@ -2654,11 +2666,13 @@ static void jsonReturnFromBlob(
     case JSONB_FLOAT: {
       double r;
       char *z;
+      if( sz==0 ) goto returnfromblob_malformed;
     to_double:
       z = sqlite3DbStrNDup(db, (const char*)&pParse->aBlob[i+n], (int)sz);
-      if( z==0 ) return;
-      sqlite3AtoF(z, &r, sqlite3Strlen30(z), SQLITE_UTF8);
+      if( z==0 ) goto returnfromblob_oom;
+      rc = sqlite3AtoF(z, &r, sqlite3Strlen30(z), SQLITE_UTF8);
       sqlite3DbFree(db, z);
+      if( rc<=0 ) goto returnfromblob_malformed;
       sqlite3_result_double(pCtx, r);
       break;
     }
@@ -2677,10 +2691,7 @@ static void jsonReturnFromBlob(
       u32 nOut = sz;
       z = (const char*)&pParse->aBlob[i+n];
       zOut = sqlite3_malloc( nOut+1 );
-      if( zOut==0 ){
-        sqlite3_result_error_nomem(pCtx);
-        break;
-      }
+      if( zOut==0 ) goto returnfromblob_oom;
       for(iIn=iOut=0; iIn<sz; iIn++){
         char c = z[iIn];
         if( c=='\\' ){
@@ -2721,10 +2732,18 @@ static void jsonReturnFromBlob(
       break;
     }
     default: {
-      sqlite3_result_error(pCtx, "malformed JSON", -1);
-      break;
+      goto returnfromblob_malformed;
     }
   }
+  return;
+
+returnfromblob_oom:
+  sqlite3_result_error_nomem(pCtx);
+  return;
+
+returnfromblob_malformed:
+  sqlite3_result_error(pCtx, "malformed JSON", -1);
+  return;
 }
 
 /*