pgsql: SQL/JSON: Fix NULL result leakage in JSON_VALUE() RETURNING json

From: Amit Langote <amitlan(at)postgresql(dot)org>
To: pgsql-committers(at)lists(dot)postgresql(dot)org
Subject: pgsql: SQL/JSON: Fix NULL result leakage in JSON_VALUE() RETURNING json
Date: 2026-11-05 07:31:27
Message-ID: E1xOrwV-00000000HDP-3Swu@gemulon.postgresql.org
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-committers

SQL/JSON: Fix NULL result leakage in JSON_VALUE() RETURNING json/jsonb

Once JSON_VALUE(... RETURNING json/jsonb) returned NULL, every later
evaluation of the same expression in the same statement also returned
NULL, even for inputs that had a valid value.

In ExecEvalJsonExprPath(), the JSON_VALUE_OP branch for RETURNING json
or jsonb converts the matched item to its string form but, unlike the
sibling branches, never sets *op->resnull to false. So a NULL result
from a previous evaluation, whether due to a JSON null item, an empty
match, or an error handled by NULL ON ERROR, remained in effect. That
caused the subsequent coercion via the type's input function, which is
guarded by that flag, to be skipped, and the valid item to be returned
as SQL NULL. The result thus depended on what earlier rows, or earlier
expressions sharing the same ExprState, had returned.

Fix by setting *op->resnull to false in that branch. Also add a
comment noting that ExecGetJsonValueItemString() takes care of that
in the final branch.

Oversight in commit 6185c9737cf, so back-patch to 17.

Bug: #19695
Reported-by: Chaitanya Choudhary <chaitanyyachoudhary(at)gmail(dot)com>
Author: Srinath Reddy Sadipiralla <srinath2133(at)gmail(dot)com>
Reviewed-by: Manu <manuelreyesbravo(at)gmail(dot)com>
Discussion: https://postgr.es/m/19695-2f2c573ef1660737@postgresql.org
Backpatch-through: 17

Branch
------
REL_17_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/31af62f380c658301061f484e94151f1ef71b013

Modified Files
--------------
src/backend/executor/execExprInterp.c | 2 +
src/test/regress/expected/sqljson_queryfuncs.out | 49 ++++++++++++++++++++++++
src/test/regress/sql/sqljson_queryfuncs.sql | 10 +++++
3 files changed, 61 insertions(+)

Browse pgsql-committers by date

  From Date Subject
Next Message Amit Langote 2026-11-05 07:31:41 pgsql: SQL/JSON: Fix NULL result leakage in JSON_VALUE() RETURNING json
Previous Message Amit Kapila 2026-11-05 04:25:46 pgsql: Avoid resetting subscription two_phase state to pending when alr