Fix jsonb subscripting to cope with toasted subscript values.
Tom Lane <tgl@sss.pgh.pa.us>
Fix jsonb subscripting to cope with toasted subscript values. jsonb_get_element() was incautious enough to use VARDATA() and VARSIZE() directly on an arbitrary text Datum. That of course fails if the Datum is short-header, compressed, or out-of-line. The typical result would be failing to match any element of a jsonb object, though matching the wrong one seems possible as well. setPathObject() was slightly brighter, in that it used VARDATA_ANY and VARSIZE_ANY_EXHDR, but that only kept it out of trouble for short-header Datums. push_path() had the same issue. This could result in faulty subscripted insertions, though keys long enough to cause a problem are likely rare in the wild. Having seen these, I looked around for unsafe usages in the rest of the adt/json* files. There are a couple of places where it's not immediately obvious that the Datum can't be compressed or out-of-line, so I added pg_detoast_datum_packed() to cope if it is. Also, remove some other usages of VARDATA/VARSIZE on Datums we just extracted from a text array. Those aren't actively broken, but they will become so if we ever start allowing short-header array elements, which does not seem like a terribly unreasonable thing to do. In any case they are not great coding examples, and they could also do with comments pointing out that we're assuming we don't need pg_detoast_datum_packed. Per report from exe-dealer@yandex.ru. Patch by me, but thanks to David Johnston for initial investigation. Back-patch to v14 where jsonb subscripting was introduced. Discussion: https://postgr.es/m/205321670615953@mail.yandex.ru
Files
| Path | Change | +/− |
|---|---|---|
| src/backend/utils/adt/jsonb_gin.c | modified | +3 −2 |
| src/backend/utils/adt/jsonb_op.c | modified | +6 −4 |
| src/backend/utils/adt/jsonfuncs.c | modified | +29 −12 |
| src/test/regress/expected/jsonb.out | modified | +34 −0 |
| src/test/regress/sql/jsonb.sql | modified | +18 −0 |
Discussion
- jsonb subscript operator returns null when key is fetched from table 3 messages · 2022-12-09 → 2022-12-12