Further improvements to the decision of whether or not a BLOB input

is JSONB.

FossilOrigin-Name: 6538813cb89f6109727481e29633e2e98f98e0257c58695e3b53e8ce237d9195

1 files changed, 8 insertions, 5 deletions

diff --git a/src/json.c b/src/json.c
index 72b52efd7..c29caa46b 100644
--- a/src/json.c
+++ b/src/json.c
@@ -3489,7 +3489,7 @@ jsonInsertIntoBlob_patherror:
 **
 ** The first byte of valid JSON text must be one of: '{', '[', '"', ' ', '\n',
 ** '\r', '\t', '-', or a digit '0' through '9'.  Of these, only a subset
-** can also be the first byte of JSONB:  '{', '[', '\n', '\t', and digits '3'
+** can also be the first byte of JSONB:  '{', '[', and digits '3'
 ** through '9'.  In every one of those cases, the payload size is 7 bytes
 ** or less.  So if we do full JSONB validation for every BLOB where the
 ** payload is less than 7 bytes, we will never get a false positive for
@@ -3497,16 +3497,19 @@ jsonInsertIntoBlob_patherror:
 */
 static int jsonArgIsJsonb(sqlite3_value *pArg, JsonParse *p){
   u32 n, sz = 0;
+  u8 c;
   if( sqlite3_value_type(pArg)!=SQLITE_BLOB ) return 0;
   p->aBlob = (u8*)sqlite3_value_blob(pArg);
   p->nBlob = (u32)sqlite3_value_bytes(pArg);
   if( p->nBlob>0
    && ALWAYS(p->aBlob!=0)
-   && (p->aBlob[0] & 0x0f)<=JSONB_OBJECT
+   && ((c = p->aBlob[0]) & 0x0f)<=JSONB_OBJECT
    && (n = jsonbPayloadSize(p, 0, &sz))>0
    && sz+n==p->nBlob
-   && ((p->aBlob[0] & 0x0f)>JSONB_FALSE || sz==0)
-   && (sz>7 || (sz&1)==0 || jsonbValidityCheck(p, 0, p->nBlob, 1)==0)
+   && ((c & 0x0f)>JSONB_FALSE || sz==0)
+   && (sz>7 
+      || (c!=0x7b && c!=0x5b && !sqlite3Isdigit(c))
+      || jsonbValidityCheck(p, 0, p->nBlob, 1)==0)
   ){
     return 1;
   }
@@ -4602,7 +4605,7 @@ static void jsonValidFunc(
       JsonParse py;
       memset(&py, 0, sizeof(py));
       if( jsonArgIsJsonb(argv[0], &py) ){
-        if( (flags & 0x04)!=0 || py.nBlob<=7 ){
+        if( flags & 0x04 ){
           /* Superficial checking only - accomplished by the
           ** jsonArgIsJsonb() call above. */
           res = 1;