From cd0f04ed0e2d9b5d689c6843752c2b2a0c2fd437 Mon Sep 17 00:00:00 2001 From: Junwang Zhao Date: Thu, 5 Sep 2024 03:32:05 +0000 Subject: [PATCH v1] fix use after free bug json_unique_check_key stores key pointing to address can be invalidated by enlargeStringInfo, use strdup to resolve this problem. Signed-off-by: Junwang Zhao --- src/backend/utils/adt/json.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/backend/utils/adt/json.c b/src/backend/utils/adt/json.c index 4eeeeaf0a6..10fe5b9950 100644 --- a/src/backend/utils/adt/json.c +++ b/src/backend/utils/adt/json.c @@ -1111,7 +1111,7 @@ json_object_agg_transfn_worker(FunctionCallInfo fcinfo, if (unique_keys) { - const char *key = &out->data[key_offset]; + const char *key = MemoryContextStrdup(aggcontext, &out->data[key_offset]); if (!json_unique_check_key(&state->unique_check.check, key, 0)) ereport(ERROR, @@ -1275,7 +1275,8 @@ json_build_object_worker(int nargs, const Datum *args, const bool *nulls, const if (unique_keys) { /* check key uniqueness after key appending */ - const char *key = &out->data[key_offset]; + const char *key = MemoryContextStrdup(unique_check.mcxt, + &out->data[key_offset]); if (!json_unique_check_key(&unique_check.check, key, 0)) ereport(ERROR, -- 2.39.2