use-after-free in jsonb_set_lax()

From: John Naylor <johncnaylorls(at)gmail(dot)com>
To: pgsql-bugs <pgsql-bugs(at)lists(dot)postgresql(dot)org>
Subject: use-after-free in jsonb_set_lax()
Date: 2026-10-15 02:44:09
Message-ID: CANWCAZY-PS=ev8TiiV1j=NoR2xLopEL8fDq0fyQZahHiP5b+Pw@mail.gmail.com
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-bugs

I received an off-list report of a crash in production using this
function. It's possible to reproduce a crash in a non-assert build
with a fuzzing script, but the easiest demo of the problem is (on an
assert build):

=# SELECT jsonb_set_lax(j, '{a}', NULL, true, t)
FROM (VALUES (jsonb_build_object('a', '1'), 'use_json_null'),
(jsonb_build_object('a', '1'), 'delete_key')) AS v(j, t);
ERROR: unknown type of jsonb container

I've attached a fix, which I plan to commit to all supported versions
in a couple days barring objections.

I didn't find any other places in the code base with a similar bug,
but of course I can't be certain.

--
John Naylor
Amazon Web Services

Attachment Content-Type Size
v1-0001-Fix-use-after-free-in-jsonb_set_lax-for-Const-NUL.patch text/x-patch 4.2 KB

Responses

Browse pgsql-bugs by date

  From Date Subject
Next Message David Rowley 2026-10-15 02:53:14 Re: PG18: use-after-free in exec partition pruning after an EPQ recheck in LockRows
Previous Message David Rowley 2026-10-15 01:25:54 Re: PG18: use-after-free in exec partition pruning after an EPQ recheck in LockRows