From: drh <>
Date: Sat, 4 Jul 2026 12:12:16 +0000 (+0000)
Subject: The jsonSkipLabel() routine, part of json_each() and json_next(), should
X-Git-Url: http://git.ipfire.org/index.cgi?a=commitdiff_plain;h=c077ff1a075014172ed365a495688093b761bf96;p=thirdparty%2Fsqlite.git

The jsonSkipLabel() routine, part of json_each() and json_next(), should
never return an index outside of the range of bytes of the input JSONB.
[bugs:/info/2026-07-04T04:58:54Z|Bug 2026-07-04T04:58:54Z]

FossilOrigin-Name: 96072f5f872c8e62dedf48a4ba47ca5f3bd55e98b122f62199a1d0be06de95b4
---

diff --git a/manifest b/manifest
index da7117396d..1d99f24dab 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Fix\spossible\sone-byte\sOOB\sread\sin\sthe\sfossildelta.c\sextension.\n[bugs:/info/2026-07-04T04:53:59Z|Bug\s2026-07-04T04:53:59Z]
-D 2026-07-04T09:22:27.831
+C The\sjsonSkipLabel()\sroutine,\spart\sof\sjson_each()\sand\sjson_next(),\sshould\nnever\sreturn\san\sindex\soutside\sof\sthe\srange\sof\sbytes\sof\sthe\sinput\sJSONB.\n[bugs:/info/2026-07-04T04:58:54Z|Bug\s2026-07-04T04:58:54Z]
+D 2026-07-04T12:12:16.747
 F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
@@ -700,7 +700,7 @@ F src/hash.h 46b92795a95bfefb210f52f0c316e9d7cdbcdd7e7fcfb0d8be796d3a5767cddf
 F src/hwtime.h 5cb15147c8583d0fc4748e1c12ea6f38c9deaeefa147a4d8d379fd9bc81fee9a
 F src/in-operator.md 10cd8f4bcd225a32518407c2fb2484089112fd71
 F src/insert.c e6e9b574b4863649e2c433f2260f226183e697df1ab73fcb8da9a85d5abcd390
-F src/json.c 3eec1d9c6b7a26f37e4aec72ff04ee28973e691a8a0556e1364bbd49103a2f75
+F src/json.c e4af4d799e4e7630c633b3b356d65e92d1781e42343ab77b8ef747c932762012
 F src/legacy.c d7874bc885906868cd51e6c2156698f2754f02d9eee1bae2d687323c3ca8e5aa
 F src/loadext.c 5cd4cd7ec6e1a46416806899086363fbf95eecd3bfb9a388b436c9a77243c902
 F src/main.c 55a7d6d35bae30545e147ab0aa8dc156066abcd4aa8e97aaa5fc6f70b4961f77
@@ -1364,7 +1364,7 @@ F test/json/json-generator.tcl dc0dd0f393800c98658fc4c47eaa6af29d4e17527380cd286
 F test/json/json-q1.txt 65f9d1cdcc4cffa9823fb73ed936aae5658700cd001fde448f68bfb91c807307
 F test/json/json-speed-check.sh 45862b216f1f8bbf16d74e2ad6ea20c773ee77774b299a7e0f76a22eb98e91f1 x
 F test/json/jsonb-q1.txt 1e180fe6491efab307e318b22879e3a736ac9a96539bbde7911a13ee5b33abc7
-F test/json101.test 34109fe1bfa384774ceea2a174de00e0b77e8a7b586bf30bdc9a60d7377ed15b
+F test/json101.test 320107839fef110de72d3950340e19ba21c7e77f09c88657eed6d4a453e4352d
 F test/json102.test ea5c9811e408e115c8fc539548deef431fda4924c23cacd79dd4b783f4449f07
 F test/json103.test e626d109cd0bdb8282ec9bf755af3befa50e3e03a255362fc53433d31e1d66d4
 F test/json104.test 1b844a70cddcfa2e4cd81a5db0657b2e61e7f00868310f24f56a9ba0114348c1
@@ -2210,8 +2210,8 @@ F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee
 F tool/warnings.sh a554d13f6e5cf3760f041b87939e3d616ec6961859c3245e8ef701d1eafc2ca2
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
 F tool/winmain.c 00c8fb88e365c9017db14c73d3c78af62194d9644feaf60e220ab0f411f3604c
-P 6ed20ab693b298b6b645ee73801ee19952e9c188fba93594634325e12de02848
-R b40730bf9c4cff05ae69daba033be6ed
+P 8001a373d1c91f92639fb34fca18f9667f1ee92eb6bfa49df06b8cc256385292
+R b41067a37609013040cce892a6305d05
 U drh
-Z ed129da9874d555da1bea1d316139af0
+Z cf57bc37eb11e4c63f1c131cfd61eba1
 # Remove this line to create a well-formed Fossil manifest.
diff --git a/manifest.uuid b/manifest.uuid
index f370d5f683..ca6e8cb132 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-8001a373d1c91f92639fb34fca18f9667f1ee92eb6bfa49df06b8cc256385292
+96072f5f872c8e62dedf48a4ba47ca5f3bd55e98b122f62199a1d0be06de95b4
diff --git a/src/json.c b/src/json.c
index b66e48b8f9..0fc3fef87a 100644
--- a/src/json.c
+++ b/src/json.c
@@ -5216,7 +5216,9 @@ static int jsonSkipLabel(JsonEachCursor *p){
   if( p->eType==JSONB_OBJECT ){
     u32 sz = 0;
     u32 n = jsonbPayloadSize(&p->sParse, p->i, &sz);
-    return p->i + n + sz;
+    sz += p->i + n;
+    if( sz >= p->sParse.nBlob ) sz = p->i;
+    return sz;
   }else{
     return p->i;
   }
diff --git a/test/json101.test b/test/json101.test
index d98487ddf1..e947d8d6b7 100644
--- a/test/json101.test
+++ b/test/json101.test
@@ -1185,4 +1185,18 @@ do_execsql_test json101-25.1 {
   SELECT json_array(0.1234567890123456789)->>0 = 0.1234567890123456789;
 } 1
 
+# Bug 2026-07-04T04:58:54Z
+#
+# The JSONB is corrupt such that the last member of the structure has
+# a label but no value.  The jsonSkipLabel() should return the index
+# of the label, making the value appear to be the same as the label
+# as far as json_each() is concerned.
+#
+do_execsql_test json101-26.1 {
+  SELECT value FROM json_each(x'CC141761133117621332176313331764133437656565') WHERE key='eee';
+} {eee}
+do_execsql_test json101-26.2 {
+  SELECT json_valid(x'CC141761133117621332176313331764133437656565',8);
+} {0}
+
 finish_test