[Tarantool-patches] [PATCH v1 1/1] sql: fix assert when MP_EXT received via netbox

[imeevma at tarantool.org]

This patch fixes an assertion or segmentation fault when getting the
value of MP_EXT via netbox.

Closes #6766
---
https://github.com/tarantool/tarantool/issues/6766
https://github.com/tarantool/tarantool/tree/imeevma/gh-6766-fix-assert-when-decoding-mp-ext

 src/box/bind.c                                | 30 ++++++++++++++++++-
 test/sql-tap/engine.cfg                       |  1 +
 .../gh-6766-fix-bind-for-mp-ext.test.lua      | 30 +++++++++++++++++++
 3 files changed, 60 insertions(+), 1 deletion(-)
 create mode 100755 test/sql-tap/gh-6766-fix-bind-for-mp-ext.test.lua

diff --git a/src/box/bind.c b/src/box/bind.c
index 441c9f46f..6672d1271 100644
--- a/src/box/bind.c
+++ b/src/box/bind.c
@@ -34,6 +34,8 @@
 #include "sql/sqlInt.h"
 #include "sql/sqlLimit.h"
 #include "sql/vdbe.h"
+#include "mp_decimal.h"
+#include "mp_uuid.h"
 
 const char *
 sql_bind_name(const struct sql_bind *bind)
@@ -99,9 +101,35 @@ sql_bind_decode(struct sql_bind *bind, int i, const char **packet)
 	case MP_BIN:
 		bind->s = mp_decode_bin(packet, &bind->bytes);
 		break;
+	case MP_EXT: {
+		int8_t ext_type;
+		const char *svp = *packet;
+		uint32_t size = mp_decode_extl(packet, &ext_type);
+		if (ext_type != MP_UUID && ext_type != MP_DECIMAL) {
+			bind->s = svp;
+			*packet += size;
+			bind->bytes = *packet - svp;
+			break;
+		}
+		*packet = svp;
+		if (ext_type == MP_UUID) {
+			if (mp_decode_uuid(packet, &bind->uuid) == NULL) {
+				diag_set(ClientError, ER_INVALID_MSGPACK,
+					 "Invalid MP_UUID MsgPack format");
+				return -1;
+			}
+		} else {
+			if (mp_decode_decimal(packet, &bind->dec) == NULL) {
+				diag_set(ClientError, ER_INVALID_MSGPACK,
+					 "Invalid MP_DECIMAL MsgPack format");
+				return -1;
+			}
+		}
+		bind->ext_type = ext_type;
+		break;
+	}
 	case MP_ARRAY:
 	case MP_MAP:
-	case MP_EXT:
 		bind->s = *packet;
 		mp_next(packet);
 		bind->bytes = *packet - bind->s;
diff --git a/test/sql-tap/engine.cfg b/test/sql-tap/engine.cfg
index 528212ab6..3bd416dd5 100644
--- a/test/sql-tap/engine.cfg
+++ b/test/sql-tap/engine.cfg
@@ -41,6 +41,7 @@
     "gh-6375-assert-on-unsupported-ext.test.lua": {},
     "gh-6485-bugs-in-decimal.test.lua": {},
     "gh-6113-assert-in-hex-on-zeroblob.test.lua": {},
+    "gh-6766-fix-bind-for-mp-ext.test.lua": {},
     "*": {
         "memtx": {"engine": "memtx"},
         "vinyl": {"engine": "vinyl"}
diff --git a/test/sql-tap/gh-6766-fix-bind-for-mp-ext.test.lua b/test/sql-tap/gh-6766-fix-bind-for-mp-ext.test.lua
new file mode 100755
index 000000000..8190917fd
--- /dev/null
+++ b/test/sql-tap/gh-6766-fix-bind-for-mp-ext.test.lua
@@ -0,0 +1,30 @@
+#!/usr/bin/env tarantool
+local test = require("sqltester")
+test:plan(2)
+
+box.cfg{listen = os.getenv('LISTEN')}
+local cn = require('net.box').connect(box.cfg.listen)
+
+test:do_test(
+    "gh-6766-1",
+    function()
+        local val = {require('decimal').new(1.5)}
+        local res = cn:execute([[SELECT typeof(?);]], val)
+        return {res.rows[1][1]}
+    end, {
+        'decimal'
+    })
+
+test:do_test(
+    "gh-6766-2",
+    function()
+        local val = {require('uuid').new()}
+        local res = cn:execute([[SELECT typeof(?);]], val)
+        return {res.rows[1][1]}
+    end, {
+        'uuid'
+    })
+
+cn:close()
+
+test:finish_test()
-- 
2.25.1