Skip to content

Commit 8ee0c94

Browse files
authored
Fix ? operator crash on an agtype null left operand (#2589)
For a scalar left operand, agtype_exists_agtype() passes the result of extract_entity_properties() straight to agtype_value_to_agtype(). For an agtype null (or an entity whose properties are null) that result is NULL, so the backend dereferences a NULL pointer and the postmaster restarts: SELECT 'null'::agtype ? '"a"'::agtype; Return false when there are no properties to search, the same answer the operator already gives for other non-container scalars such as '1' or '"s"'. Add regression cases to jsonb_operators. Fixes 2562
1 parent 3eeb20b commit 8ee0c94

3 files changed

Lines changed: 23 additions & 1 deletion

File tree

‎regress/expected/jsonb_operators.out‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -189,6 +189,18 @@ SELECT '{"n":null,"a":1,"b":[1,2],"c":{"1":2},"d":{"1":[2,3]}}'::agtype ? '["e1"
189189
f
190190
(1 row)
191191

192+
SELECT 'null'::agtype ? '"a"'::agtype;
193+
?column?
194+
----------
195+
f
196+
(1 row)
197+
198+
SELECT 'null'::agtype ? 'null'::agtype;
199+
?column?
200+
----------
201+
f
202+
(1 row)
203+
192204
-- errors out
193205
SELECT '{"n":null,"a":1,"b":[1,2],"c":{"1":2},"d":{"1":[2,3]}}'::agtype ? 'e1';
194206
ERROR: invalid input syntax for type agtype

‎regress/sql/jsonb_operators.sql‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,8 @@ SELECT '{"n":null,"a":1,"b":[1,2],"c":{"1":2},"d":{"1":[2,3]}}'::agtype ? '["n",
6060
SELECT '{"n":null,"a":1,"b":[1,2],"c":{"1":2},"d":{"1":[2,3]}}'::agtype ? '{"n": null}';
6161
SELECT '{"n":null,"a":1,"b":[1,2],"c":{"1":2},"d":{"1":[2,3]}}'::agtype ? '{"n": null, "b": true}';
6262
SELECT '{"n":null,"a":1,"b":[1,2],"c":{"1":2},"d":{"1":[2,3]}}'::agtype ? '["e1"]';
63+
SELECT 'null'::agtype ? '"a"'::agtype;
64+
SELECT 'null'::agtype ? 'null'::agtype;
6365

6466
-- errors out
6567
SELECT '{"n":null,"a":1,"b":[1,2],"c":{"1":2},"d":{"1":[2,3]}}'::agtype ? 'e1';

‎src/backend/utils/adt/agtype_ops.c‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1322,7 +1322,15 @@ Datum agtype_exists_agtype(PG_FUNCTION_ARGS)
13221322

13231323
if (AGT_ROOT_IS_SCALAR(agt))
13241324
{
1325-
agt = agtype_value_to_agtype(extract_entity_properties(agt, false));
1325+
agtype_value *properties = extract_entity_properties(agt, false);
1326+
1327+
/* an agtype null (or null properties) has no keys to look up */
1328+
if (properties == NULL)
1329+
{
1330+
PG_RETURN_BOOL(false);
1331+
}
1332+
1333+
agt = agtype_value_to_agtype(properties);
13261334
}
13271335

13281336
if (AGT_ROOT_IS_SCALAR(key))

0 commit comments

Comments
 (0)