pgsql: SQL/JSON: Fix NULL result leakage in JSON_VALUE() RETURNING json

From: Amit Langote <amitlan(at)postgresql(dot)org>
To: pgsql-committers(at)lists(dot)postgresql(dot)org
Subject: pgsql: SQL/JSON: Fix NULL result leakage in JSON_VALUE() RETURNING json
Date: 2026-11-05 07:31:55
Message-ID: E1xOrwx-00000000HFu-2XHa@gemulon.postgresql.org
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-committers

SQL/JSON: Fix NULL result leakage in JSON_VALUE() RETURNING json/jsonb

Once JSON_VALUE(... RETURNING json/jsonb) returned NULL, every later
evaluation of the same expression in the same statement also returned
NULL, even for inputs that had a valid value.

In ExecEvalJsonExprPath(), the JSON_VALUE_OP branch for RETURNING json
or jsonb converts the matched item to its string form but, unlike the
sibling branches, never sets *op->resnull to false. So a NULL result
from a previous evaluation, whether due to a JSON null item, an empty
match, or an error handled by NULL ON ERROR, remained in effect. That
caused the subsequent coercion via the type's input function, which is
guarded by that flag, to be skipped, and the valid item to be returned
as SQL NULL. The result thus depended on what earlier rows, or earlier
expressions sharing the same ExprState, had returned.

Fix by setting *op->resnull to false in that branch. Also add a
comment noting that ExecGetJsonValueItemString() takes care of that
in the final branch.

Oversight in commit 6185c9737cf, so back-patch to 17.

Bug: #19695
Reported-by: Chaitanya Choudhary <chaitanyyachoudhary(at)gmail(dot)com>
Author: Srinath Reddy Sadipiralla <srinath2133(at)gmail(dot)com>
Reviewed-by: Manu <manuelreyesbravo(at)gmail(dot)com>
Discussion: https://postgr.es/m/19695-2f2c573ef1660737@postgresql.org
Backpatch-through: 17

Branch
------
REL_19_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/2f2c923c33504c32bc70d359756c451769110c05

Modified Files
--------------
src/backend/executor/execExprInterp.c | 2 +
src/test/regress/expected/sqljson_queryfuncs.out | 49 ++++++++++++++++++++++++
src/test/regress/sql/sqljson_queryfuncs.sql | 10 +++++
3 files changed, 61 insertions(+)

Browse pgsql-committers by date

  From Date Subject
Next Message Amit Langote 2026-11-05 07:32:09 pgsql: SQL/JSON: Fix NULL result leakage in JSON_VALUE() RETURNING json
Previous Message Amit Langote 2026-11-05 07:31:41 pgsql: SQL/JSON: Fix NULL result leakage in JSON_VALUE() RETURNING json