Fix jsonb_object_agg crash after eliminating null-valued pairs.
Tom Lane <tgl@sss.pgh.pa.us>
Fix jsonb_object_agg crash after eliminating null-valued pairs. In commit b61aa76e4 I added an assumption in jsonb_object_agg_finalfn that it'd be okay to apply uniqueifyJsonbObject repeatedly to a JsonbValue. I should have studied that code more closely first, because in skip_nulls mode it removed leading nulls by changing the "pairs" array start pointer. This broke the data structure's invariants in two ways: pairs no longer references a repalloc-able chunk, and the distance from pairs to the end of its array is less than parseState->size. So any subsequent addition of more pairs is at high risk of clobbering memory and/or causing repalloc to crash. Unfortunately, adding more pairs is exactly what will happen when the aggregate is being used as a window function. Fix by rewriting uniqueifyJsonbObject to not do that. The prior coding had little to recommend it anyway. Reported-by: Alexander Lakhin <exclusion@gmail.com> Author: Tom Lane <tgl@sss.pgh.pa.us> Discussion: https://postgr.es/m/ec5e96fb-ee49-4e5f-8a09-3f72b4780538@gmail.com
Files
| Path | Change | +/− |
|---|---|---|
| src/backend/utils/adt/jsonb.c | modified | +5 −2 |
| src/backend/utils/adt/jsonb_util.c | modified | +20 −29 |
| src/test/regress/expected/jsonb.out | modified | +32 −0 |
| src/test/regress/sql/jsonb.sql | modified | +6 −0 |
Discussion
- Making jsonb_agg() faster 27 messages · 2025-07-22 → 2026-01-06