Re: use-after-free in jsonb_set_lax()

On Thu, Oct 15, 2026 at 11:08 AM Manu <manuelreyesbravo(at)gmail(dot)com> wrote:
> > I didn't find any other places in the code base with a similar bug,
> > but of course I can't be certain.
>
> I swept for siblings and found none. Of the 444 writes to
> fcinfo->args[] in the backend, all go into a frame the function built
> itself or an executor/planner frame, except 15 into a caller-supplied
> frame; jsonb_set_lax is the only SQL-callable one among those. Const
> args are written once at expression init in the expected places
> (ExecInitFunc, the JSON constructors). Same on 14-17. A differential
> multi-row vs per-row fuzz over the jsonb family (132k cases, cassert
> and ASan) only ever fires in jsonb_set_lax, and is clean with v1.

Please don't copy and paste LLM output into emails. It's annoying.

--
John Naylor
Amazon Web Services