Bug in jsonb_in function (14 & 15 version are affected)

From: Nikolay Shaplov <dhyan(at)nataraj(dot)su>
To: pgsql-hackers <pgsql-hackers(at)postgresql(dot)org>
Subject: Bug in jsonb_in function (14 & 15 version are affected)
Date: 2023-03-13 14:18:15
Message-ID: 7332649.x5DLKWyVIX@thinkpad-pgpro
Views: Raw Message | Whole Thread | Download mbox | Resend email
Lists: pgsql-hackers


I found a bug in jsonb_in function (it converts json from sting representation
into jsonb internal representation).

To reproduce this bug (the way I found it) you should get 8bit instance of postgres db:

1. add en_US locale (dpkg-reconfigure locales in debian)
2. initdb with latin1 encoding:

LANG=en_US ./initdb --encoding=LATIN1 -D my_pg_data

3. run database and execute the query:

SELECT E'{\x0a"\x5cb\x5c"\x5c\x5c\x5c/\x5cb\x5cf\x5cn\x5cr\x5ct\x5c"\x5c\x5c\x5c\x5crZt\x5c"\x5c\x5c\x5c/\x5cb\x5c"\x5c\x5c\x5c/\x5cb\x5c"\x5cu000f0\x5cu000f0000000000000000000000000000000000000000000000000000000\x5cuDFFF000000000000000000000000000000000000000000000000000000000000"0000000000000000000000000000000\x5cu0000000000000000000\xb4\x5cuDBFF\x5cuDFFF00000000000000000002000000000000000000000000000000000000000000000000000000000000000\x5cuDBFF'::jsonb;

In postgres 14 and 15, the backend will crash.

The packtrace produce with ASan is in the attached file.

This bug was found while fuzzing postgres input functions, using AFL++.
For now we are using lightweight wrapper around input functions that
create minimal environment for these functions to run conversion, and run the, in fuzzer.

My colleagues (they will come here shortly) have narrowed down this query to

SELECT E'\n"\\u00000"'::jsonb;

and says that is crashes even in utf8 locale.

They also have a preliminary version of patch to fix it. They will tell about it soon, I hope.

Nikolay Shaplov aka Nataraj
Fuzzing Engineer at Postgres Professional
Matrix IM: @dhyan:nataraj.su

Attachment Content-Type Size
backtrace.txt text/plain 3.7 KB


Browse pgsql-hackers by date

  From Date Subject
Next Message Andrew Dunstan 2023-03-13 14:19:50 Re: buildfarm + meson
Previous Message Önder Kalacı 2023-03-13 14:16:23 Re: [PATCH] Use indexes on the subscriber when REPLICA IDENTITY is full on the publisher