| From: | John Naylor <johncnaylorls(at)gmail(dot)com> |
|---|---|
| To: | pgsql-bugs <pgsql-bugs(at)lists(dot)postgresql(dot)org> |
| Subject: | use-after-free in jsonb_set_lax() |
| Date: | 2026-10-15 02:44:09 |
| Message-ID: | CANWCAZY-PS=ev8TiiV1j=NoR2xLopEL8fDq0fyQZahHiP5b+Pw@mail.gmail.com |
| Views: | Whole Thread | Raw Message | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-bugs |
I received an off-list report of a crash in production using this
function. It's possible to reproduce a crash in a non-assert build
with a fuzzing script, but the easiest demo of the problem is (on an
assert build):
=# SELECT jsonb_set_lax(j, '{a}', NULL, true, t)
FROM (VALUES (jsonb_build_object('a', '1'), 'use_json_null'),
(jsonb_build_object('a', '1'), 'delete_key')) AS v(j, t);
ERROR: unknown type of jsonb container
I've attached a fix, which I plan to commit to all supported versions
in a couple days barring objections.
I didn't find any other places in the code base with a similar bug,
but of course I can't be certain.
--
John Naylor
Amazon Web Services
| Attachment | Content-Type | Size |
|---|---|---|
| v1-0001-Fix-use-after-free-in-jsonb_set_lax-for-Const-NUL.patch | text/x-patch | 4.2 KB |
| From | Date | Subject | |
|---|---|---|---|
| Next Message | David Rowley | 2026-10-15 02:53:14 | Re: PG18: use-after-free in exec partition pruning after an EPQ recheck in LockRows |
| Previous Message | David Rowley | 2026-10-15 01:25:54 | Re: PG18: use-after-free in exec partition pruning after an EPQ recheck in LockRows |