Fix unsafe use of strtol() on a non-null-terminated Text datum.

tglsfdc · tglsfdc · commit 384dfbde1933 · 2016-03-23T10:43:13.000-04:00
jsonb_set() could produce wrong answers or incorrect error reports, or in the worst case even crash, when trying to convert a path-array element into an integer for use as an array subscript. Per report from Vitaly Burovoy. Back-patch to 9.5 where the faulty code was introduced (in commit c694701). Michael Paquier
diff --git a/src/backend/utils/adt/jsonfuncs.c b/src/backend/utils/adt/jsonfuncs.c
@@ -3873,7 +3873,7 @@ setPathArray(JsonbIterator **it, Datum *path_elems, bool *path_nulls,
 	/* pick correct index */
 	if (level < path_len && !path_nulls[level])
 	{
-		char	   *c = VARDATA_ANY(path_elems[level]);
+		char	   *c = TextDatumGetCString(path_elems[level]);
 		long		lindex;
 
 		errno = 0;

Original file line number	Diff line number	Diff line change
`@@ -3873,7 +3873,7 @@ setPathArray(JsonbIterator *it, Datum path_elems, bool *path_nulls,`
`3873`	`3873`	`/* pick correct index */`
`3874`	`3874`	`if (level < path_len && !path_nulls[level])`
`3875`	`3875`	`{`
`3876`		`- char *c = VARDATA_ANY(path_elems[level]);`
	`3876`	`+ char *c = TextDatumGetCString(path_elems[level]);`
`3877`	`3877`	`long lindex;`
`3878`	`3878`
`3879`	`3879`	`errno = 0;`