From: drh <>
Date: Sat, 4 Jul 2026 08:48:52 +0000 (+0000)
Subject: Fix possible 1-byte OOB read when decoding a malformed FLOAT5 element
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=40b811a32966618348e9e0de4c0f0c51d14dc9e4;p=thirdparty%2Fsqlite.git

Fix possible 1-byte OOB read when decoding a malformed FLOAT5 element
in JSONB.
[bugs:/info/2026-07-04T04:59:19Z|Bug 2026-07-04T04:59:19Z]

FossilOrigin-Name: 6ed20ab693b298b6b645ee73801ee19952e9c188fba93594634325e12de02848
---

diff --git a/manifest b/manifest
index 6ace5cee81..52b9cec38c 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Improved\sdata\svalidation\sin\sfts5SecureDeleteOverflow().\n[bugs:/info/2026-07-03T19:16:18Z|Bug\s2026-07-03T19:16:18Z]
-D 2026-07-03T20:26:45.710
+C Fix\spossible\s1-byte\sOOB\sread\swhen\sdecoding\sa\smalformed\sFLOAT5\selement\nin\sJSONB.\n[bugs:/info/2026-07-04T04:59:19Z|Bug\s2026-07-04T04:59:19Z]
+D 2026-07-04T08:48:52.541
 F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
@@ -700,7 +700,7 @@ F src/hash.h 46b92795a95bfefb210f52f0c316e9d7cdbcdd7e7fcfb0d8be796d3a5767cddf
 F src/hwtime.h 5cb15147c8583d0fc4748e1c12ea6f38c9deaeefa147a4d8d379fd9bc81fee9a
 F src/in-operator.md 10cd8f4bcd225a32518407c2fb2484089112fd71
 F src/insert.c e6e9b574b4863649e2c433f2260f226183e697df1ab73fcb8da9a85d5abcd390
-F src/json.c 74e903d4b84171b674727edc67eb8e89190eee0e7b737210f2af5b79db2f3bff
+F src/json.c 3eec1d9c6b7a26f37e4aec72ff04ee28973e691a8a0556e1364bbd49103a2f75
 F src/legacy.c d7874bc885906868cd51e6c2156698f2754f02d9eee1bae2d687323c3ca8e5aa
 F src/loadext.c 5cd4cd7ec6e1a46416806899086363fbf95eecd3bfb9a388b436c9a77243c902
 F src/main.c 55a7d6d35bae30545e147ab0aa8dc156066abcd4aa8e97aaa5fc6f70b4961f77
@@ -1375,7 +1375,7 @@ F test/json108.test 0a5f1e2d4b35a1bc33052563d2a5ede03052e2099e58cb424547656c898e
 F test/json109.test 441cea5d73c24a1a34d284101740dfae5a082237c048c8a66b03aeebe5e3643e
 F test/json501.test b95e2d14988b682a5cadf079dd6162f0f85fb74cd59c6b1f1624110104a974eb
 F test/json502.test 4ef68e4f272dfb083d4cbceb4e9e51d67ec1186a185e0c13637c50a4dc2f9796
-F test/jsonb01.test f4cdfb4cf5a0c940091b17675ed9583f45add0c938f07d65b0de0e19d3a9a101
+F test/jsonb01.test f8137807a3c05cd9bc0be6e13cc65c98300cfd67de5f9dfcd8dacd2b09582fa9
 F test/keyword1.test 37ef6bba5d2ed5b07ecdd6810571de2956599dff
 F test/kvtest.c 6e0228409ea7ca0497dad503fbd109badb5e59545d131014b6aaac68b56f484a
 F test/lastinsert.test 42e948fd6442f07d60acbd15d33fb86473e0ef63
@@ -2210,8 +2210,8 @@ F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee
 F tool/warnings.sh a554d13f6e5cf3760f041b87939e3d616ec6961859c3245e8ef701d1eafc2ca2
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
 F tool/winmain.c 00c8fb88e365c9017db14c73d3c78af62194d9644feaf60e220ab0f411f3604c
-P b2816b4d6a2a526e50219aad6051627595ae3a02ef125b5026db6e33509efb0c
-R d2ed02a9ca954198c8eb82e797c436d8
+P bb1588f04a745ff130edf300f1216e0957c0de28734ccdba1b8a6a4a161dbddf
+R 5102c382c6ac40b4f1acd371e185752a
 U drh
-Z 1a763b108acd101d2173a8f2191a1843
+Z 5124bdb1fb9fc1654f1a65cb02a40595
 # Remove this line to create a well-formed Fossil manifest.
diff --git a/manifest.uuid b/manifest.uuid
index 445cad06cb..51a707bdc1 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-bb1588f04a745ff130edf300f1216e0957c0de28734ccdba1b8a6a4a161dbddf
+6ed20ab693b298b6b645ee73801ee19952e9c188fba93594634325e12de02848
diff --git a/src/json.c b/src/json.c
index d1e71a22ed..b66e48b8f9 100644
--- a/src/json.c
+++ b/src/json.c
@@ -2252,7 +2252,8 @@ static u32 jsonTranslateBlobToText(
       if( sz==0 ) goto malformed_jsonb;
       if( zIn[0]=='-' ){
         jsonAppendChar(pOut, '-');
-        k++;
+        if( sz<=1 ) goto malformed_jsonb;
+        k = 1;
       }
       if( zIn[k]=='.' ){
         jsonAppendChar(pOut, '0');
diff --git a/test/jsonb01.test b/test/jsonb01.test
index 8f16428dcc..05f160468b 100644
--- a/test/jsonb01.test
+++ b/test/jsonb01.test
@@ -50,4 +50,11 @@ do_catchsql_test jsonb01-2.0 {
   SELECT x'8ce6ffffffff171333' -> '$';
 } {1 {malformed JSON}}
 
+# Bug 2026-07-04T04:59:19Z
+# Malformed FLOAT5 within a JSONB
+#
+do_catchsql_test jsonb01-3.0 {
+  SELECT json(x'6B37616263162d');
+} {1 {malformed JSON}}
+
 finish_test