Le 10/11/2026 à 4:39 AM, Martin Mirchev a écrit :
Hi Christopher!
Thank you for merging the stick-table fix. I checked your mjson version against
master (64d597032b) and against my v2, with an ASan+UBSan build and the
json_query reproducer, using the headers from your mail plus a nested one ({"a":
[{"b":1},[5,6],{"c":[7,8]}]}).
It fixes the issue. On master, the paths ending with a backslash ("$.a\",
"$.b\") and the truncated indexes ("$.a[", "$.a[0", "$.a[1", "$.a[]", "$[",
"$[0", "$[1", "$[]", "$.a[2].c[1", "$.a[1][0") all give a heap-buffer-overflow
READ. With your patch none of them reports anything, and all of them return an
empty result.
Well-formed paths give the same results as on master and with my v2: "$.a",
"$.a[0]" to "$.a[3]", "$[0]" to "$[2]", "$.a[00]", "$.a[01]", "$.a[1][0]",
"$.a[1][1]", "$.a[0].b" and "$.a[2].c[1]". I did not find a problem in the code:
skip_idx() never reads past the trailing zero, and when it fails the element is
simply not matched, since i1 only grows after that. The build has no warnings. I
still could not run the reg-tests themselves.
The only behaviour change is the one you describe: "$.a[x]" (index 0 on master)
and "$.a[1 ]", "$.a[+1]", "$.a[1x]" (index 1 on master) now match nothing. As
these only come from a malformed configuration, I think the stricter version is
better, so I am fine with you merging yours instead of mine.
Thanks ! now merged.
--
Christopher Faulet
