sfc-gh-dachristensen opened a new pull request, #2407:
URL: https://github.com/apache/age/pull/2407
strcmp(str, "") returns 0 (false) when str is empty, meaning the check is
inverted: it returns NULL when parsing succeeds and continues when parsing
fails. This allows non-numeric strings to pass through as array indices,
leading to type confusion and potentially incorrect memory access.
The strcmp logic handles most cases correctly (non-numeric strings return
NULL, valid integers pass through). However, the empty string "" is accepted as
a valid array index of 0: [10, 20, 30] #> '[""]' returns 10 instead of NULL.
This occurs because strtol("") sets lindex=0 and str="", so strcmp("", "")
returns 0, bypassing the error check.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
