agora inbox for pgsql-committers@postgresql.orghelp / color / mirror / Atom feed
pgsql: IS JSON/JSON(): Protect against expressions uncoercible to text 4+ messages / 1 participants [nested] [flat]
* pgsql: IS JSON/JSON(): Protect against expressions uncoercible to text @ 2026-06-11 14:19 Álvaro Herrera <alvherre@kurilemu.de> 0 siblings, 0 replies; 4+ messages in thread From: Álvaro Herrera @ 2026-06-11 14:19 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org IS JSON/JSON(): Protect against expressions uncoercible to text transformJsonParseArg() was not careful enough on generation of transformed expressions when starting from expressions that are not coercible to text but are in the string type category: it failed to verify that coerce_to_target_type() succeeds, and returned a NULL pointer. This leads to a later NULL dereference and crash at executor time. This escaped noticed because it cannot happen for built-in types, all of which have casts to text. Only user-created types are potentially problematic. Fix by raising an error when a cast to text doesn't exist. This mistake came in with commit 6ee30209a6f1. Author: Ayush Tiwari <ayushtiwari.slg01@gmail.com> Reported-by: Chi Zhang <798604270@qq.com> Reviewed-by: Srinath Reddy Sadipiralla <srinath2133@gmail.com> Backpatch-through: 16 Discussion: https://postgr.es/m/19491-7aafc221ec63f288@postgresql.org Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/7dd15325952fe85521b1fefea3ad39cf1b46e0c8 Modified Files -------------- src/backend/nodes/makefuncs.c | 2 ++ src/backend/parser/parse_expr.c | 10 +++++++++ src/test/regress/expected/sqljson.out | 38 +++++++++++++++++++++++++++++++++++ src/test/regress/sql/sqljson.sql | 22 ++++++++++++++++++++ 4 files changed, 72 insertions(+) ^ permalink raw reply [nested|flat] 4+ messages in thread
* pgsql: IS JSON/JSON(): Protect against expressions uncoercible to text @ 2026-06-11 14:19 Álvaro Herrera <alvherre@kurilemu.de> 0 siblings, 0 replies; 4+ messages in thread From: Álvaro Herrera @ 2026-06-11 14:19 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org IS JSON/JSON(): Protect against expressions uncoercible to text transformJsonParseArg() was not careful enough on generation of transformed expressions when starting from expressions that are not coercible to text but are in the string type category: it failed to verify that coerce_to_target_type() succeeds, and returned a NULL pointer. This leads to a later NULL dereference and crash at executor time. This escaped noticed because it cannot happen for built-in types, all of which have casts to text. Only user-created types are potentially problematic. Fix by raising an error when a cast to text doesn't exist. This mistake came in with commit 6ee30209a6f1. Author: Ayush Tiwari <ayushtiwari.slg01@gmail.com> Reported-by: Chi Zhang <798604270@qq.com> Reviewed-by: Srinath Reddy Sadipiralla <srinath2133@gmail.com> Backpatch-through: 16 Discussion: https://postgr.es/m/19491-7aafc221ec63f288@postgresql.org Branch ------ REL_18_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/35d9a6263407563f9948a38fced5419deab297a2 Modified Files -------------- src/backend/nodes/makefuncs.c | 2 ++ src/backend/parser/parse_expr.c | 10 +++++++++ src/test/regress/expected/sqljson.out | 38 +++++++++++++++++++++++++++++++++++ src/test/regress/sql/sqljson.sql | 22 ++++++++++++++++++++ 4 files changed, 72 insertions(+) ^ permalink raw reply [nested|flat] 4+ messages in thread
* pgsql: IS JSON/JSON(): Protect against expressions uncoercible to text @ 2026-06-11 14:19 Álvaro Herrera <alvherre@kurilemu.de> 0 siblings, 0 replies; 4+ messages in thread From: Álvaro Herrera @ 2026-06-11 14:19 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org IS JSON/JSON(): Protect against expressions uncoercible to text transformJsonParseArg() was not careful enough on generation of transformed expressions when starting from expressions that are not coercible to text but are in the string type category: it failed to verify that coerce_to_target_type() succeeds, and returned a NULL pointer. This leads to a later NULL dereference and crash at executor time. This escaped noticed because it cannot happen for built-in types, all of which have casts to text. Only user-created types are potentially problematic. Fix by raising an error when a cast to text doesn't exist. This mistake came in with commit 6ee30209a6f1. Author: Ayush Tiwari <ayushtiwari.slg01@gmail.com> Reported-by: Chi Zhang <798604270@qq.com> Reviewed-by: Srinath Reddy Sadipiralla <srinath2133@gmail.com> Backpatch-through: 16 Discussion: https://postgr.es/m/19491-7aafc221ec63f288@postgresql.org Branch ------ REL_17_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/d0acd2535b4adb21ad952d12e0f8c3fb25999d28 Modified Files -------------- src/backend/nodes/makefuncs.c | 2 ++ src/backend/parser/parse_expr.c | 10 ++++++++++ src/test/regress/expected/sqljson.out | 36 +++++++++++++++++++++++++++++++++++ src/test/regress/sql/sqljson.sql | 22 +++++++++++++++++++++ 4 files changed, 70 insertions(+) ^ permalink raw reply [nested|flat] 4+ messages in thread
* pgsql: IS JSON/JSON(): Protect against expressions uncoercible to text @ 2026-06-11 14:19 Álvaro Herrera <alvherre@kurilemu.de> 0 siblings, 0 replies; 4+ messages in thread From: Álvaro Herrera @ 2026-06-11 14:19 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org IS JSON/JSON(): Protect against expressions uncoercible to text transformJsonParseArg() was not careful enough on generation of transformed expressions when starting from expressions that are not coercible to text but are in the string type category: it failed to verify that coerce_to_target_type() succeeds, and returned a NULL pointer. This leads to a later NULL dereference and crash at executor time. This escaped noticed because it cannot happen for built-in types, all of which have casts to text. Only user-created types are potentially problematic. Fix by raising an error when a cast to text doesn't exist. This mistake came in with commit 6ee30209a6f1. Author: Ayush Tiwari <ayushtiwari.slg01@gmail.com> Reported-by: Chi Zhang <798604270@qq.com> Reviewed-by: Srinath Reddy Sadipiralla <srinath2133@gmail.com> Backpatch-through: 16 Discussion: https://postgr.es/m/19491-7aafc221ec63f288@postgresql.org Branch ------ REL_16_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/60abb3c7317586911606f35ac192a647a699ac12 Modified Files -------------- src/backend/nodes/makefuncs.c | 2 ++ src/backend/parser/parse_expr.c | 10 ++++++++++ src/test/regress/expected/sqljson.out | 31 +++++++++++++++++++++++++++++++ src/test/regress/sql/sqljson.sql | 20 ++++++++++++++++++++ 4 files changed, 63 insertions(+) ^ permalink raw reply [nested|flat] 4+ messages in thread
end of thread, other threads:[~2026-06-11 14:19 UTC | newest] Thread overview: 4+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2026-06-11 14:19 pgsql: IS JSON/JSON(): Protect against expressions uncoercible to text Álvaro Herrera <alvherre@kurilemu.de> 2026-06-11 14:19 pgsql: IS JSON/JSON(): Protect against expressions uncoercible to text Álvaro Herrera <alvherre@kurilemu.de> 2026-06-11 14:19 pgsql: IS JSON/JSON(): Protect against expressions uncoercible to text Álvaro Herrera <alvherre@kurilemu.de> 2026-06-11 14:19 pgsql: IS JSON/JSON(): Protect against expressions uncoercible to text Álvaro Herrera <alvherre@kurilemu.de>
This inbox is served by agora; see mirroring instructions for how to clone and mirror all data and code used for this inbox