Re: use-after-free in jsonb_set_lax()

On Thu, 2026-10-15 at 09:44 +0700, John Naylor wrote:
> I received an off-list report of a crash in production using this
> function. It's possible to reproduce a crash in a non-assert build
> with a fuzzing script, but the easiest demo of the problem is (on an
> assert build):
>
> =# SELECT jsonb_set_lax(j, '{a}', NULL, true, t)
> FROM (VALUES (jsonb_build_object('a', '1'), 'use_json_null'),
> (jsonb_build_object('a', '1'), 'delete_key')) AS v(j, t);
> ERROR: unknown type of jsonb container
>
> I've attached a fix, which I plan to commit to all supported versions
> in a couple days barring objections.
>
> I didn't find any other places in the code base with a similar bug,
> but of course I can't be certain.

Funny, I also received a bug report about a crash in jsonb_set_lax()
yesterday, and your patch fixes the problem.

The reproducer I got was

WITH RECURSIVE c AS ( SELECT 1 n,
jsonb_set_lax('{"a":1}'::jsonb,'{a}',NULL,true,'use_json_null') j
UNION ALL
SELECT n+1, jsonb_set_lax(jsonb_build_object('n',n,'p',j,'x',repeat('A',500)),'{n}',NULL,true,
CASE WHEN n%2=0 THEN 'delete_key' ELSE 'use_json_null' END)
FROM c WHERE n<80
) SELECT n FROM c ORDER BY n DESC LIMIT 1;

So, +1 from me!

Yours,
Laurenz Albe