thevar1able/ClickHouse
1
0
Fork 0
mirror of https://github.com/ClickHouse/ClickHouse.git synced 2024-09-20 16:50:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #5902 from yandex/fix-visit-param-extract-raw

Browse Source 
Fixed buffer underflow in visitParamExtractRaw
This commit is contained in:
alexey-milovidov 2019-07-06 20:34:46 +03:00 committed by GitHub
commit 758de14138
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
5 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
dbms/src/Functions/FunctionsVisitParam.h
View File

@ -100,7 +100,7 @@ struct ExtractRaw
for (auto extract_begin = pos; pos != end; ++pos)
{
if (*pos == current_expect_end)
if (current_expect_end && *pos == current_expect_end)
{
expects_end.pop_back();
current_expect_end = expects_end.empty() ? 0 : expects_end.back();
@ -192,7 +192,7 @@ struct ExtractParamImpl
/// We check that the entry does not pass through the boundaries of strings.
if (pos + needle.size() < begin + offsets[i])
res[i] = ParamExtractor::extract(pos + needle.size(), begin + offsets[i]);
res[i] = ParamExtractor::extract(pos + needle.size(), begin + offsets[i] - 1); /// don't include terminating zero
else
res[i] = 0;

1
dbms/tests/queries/0_stateless/00961_visit_param_buffer_underflow.reference Normal file
View File

@ -0,0 +1 @@

1
dbms/tests/queries/0_stateless/00961_visit_param_buffer_underflow.sql Normal file
View File

@ -0,0 +1 @@
SELECT visitParamExtractRaw('\"a\":', 'a');

4
dbms/tests/queries/0_stateless/00962_visit_param_various.reference Normal file
View File

@ -0,0 +1,4 @@
123
Hello
Hello
0

5
dbms/tests/queries/0_stateless/00962_visit_param_various.sql Normal file
View File

@ -0,0 +1,5 @@
SELECT visitParamExtractUInt('"a":123', 'a');
SELECT visitParamExtractString('"a":"Hello"', 'a');
SELECT visitParamExtractRaw('"a":Hello}', 'a');
SELECT sum(ignore(visitParamExtractRaw(concat('{"a":', reinterpretAsString(rand64())), 'a'))) FROM numbers(1000000);