From 2271d002d5c305441398e8f7a295f18ec3c132a9 Mon Sep 17 00:00:00 2001 From: Andrew Dunstan Date: Fri, 12 Jun 2015 19:26:03 -0400 Subject: Fix "path" infrastructure bug affecting jsonb_set() jsonb_set() and other clients of the setPathArray() utility function could get spurious results when an array integer subscript is provided that is not within the range of int. To fix, ensure that the value returned by strtol() within setPathArray() is within the range of int; when it isn't, assume an invalid input in line with existing, similar cases. The path-orientated operators that appeared in PostgreSQL 9.3 and 9.4 do not call setPathArray(), and already independently take this precaution, so no change there. Peter Geoghegan --- src/backend/utils/adt/jsonfuncs.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'src/backend/utils/adt/jsonfuncs.c') diff --git a/src/backend/utils/adt/jsonfuncs.c b/src/backend/utils/adt/jsonfuncs.c index c14d3f73fca..13d5b7af2f4 100644 --- a/src/backend/utils/adt/jsonfuncs.c +++ b/src/backend/utils/adt/jsonfuncs.c @@ -3814,11 +3814,14 @@ setPathArray(JsonbIterator **it, Datum *path_elems, bool *path_nulls, if (level < path_len && !path_nulls[level]) { char *c = VARDATA_ANY(path_elems[level]); + long lindex; errno = 0; - idx = (int) strtol(c, &badp, 10); - if (errno != 0 || badp == c) + lindex = strtol(c, &badp, 10); + if (errno != 0 || badp == c || lindex > INT_MAX || lindex < INT_MIN) idx = nelems; + else + idx = lindex; } else idx = nelems; -- cgit v1.2.3