json_object with repeat a long num is wrong.

[xiekeyi98]

Description

Bug Report

Please answer these questions before submitting your issue. Thanks!

1. What did you do?
   If possible, provide a recipe for reproducing the error.

select json_object( REPEAT('a', 2 * 16 ), 1 );
select json_object( REPEAT('a', 64 * 1024), 1 );

2. What did you expect to see?

In MySQL

mysql> select json_object( REPEAT('a', 2 * 16), 1 );
+-----------------------------------------+
| json_object( REPEAT('a', 2 * 16), 1 )   |
+-----------------------------------------+
| {"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa": 1} |
+-----------------------------------------+
1 row in set (0.00 sec)
mysql> select version();
+-------------------------+
| version()               |
+-------------------------+
| 5.7.25-0ubuntu0.18.04.2 |
+-------------------------+
1 row in set (0.00 sec)

mysql> 

( AS 64 * 1024 , is too long , will not print in here).

3. What did you see instead?

In TiDB

mysql> select json_object( REPEAT('a', 2 * 16), 1 );
+-----------------------------------------+
| json_object( REPEAT('a', 2 * 16), 1 )   |
+-----------------------------------------+
| {"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa": 1} |
+-----------------------------------------+
1 row in set (0.00 sec)

mysql> select json_object( REPEAT('a', 64 * 1024), 1 );
+------------------------------------------+
| json_object( REPEAT('a', 64 * 1024), 1 ) |
+------------------------------------------+
| {"": 1}                                  |
+------------------------------------------+
1 row in set (0.01 sec)

mysql> select tidb_version()\G
*************************** 1. row ***************************
tidb_version(): Release Version: v3.0.0-beta-321-gc6a757b24
Git Commit Hash: c6a757b2435965a72ada9d61ea8b7a367bd89b5f
Git Branch: master
UTC Build Time: 2019-04-02 02:38:04
GoVersion: go version go1.12.1 linux/amd64
Race Enabled: false
TiKV Min Version: 2.1.0-alpha.1-ff3dd160846b7d1aed9079c389fc188f7f5ea13e
Check Table Before Drop: false
1 row in set (0.01 sec)

mysql> 

SIG slack channel

#sig-exec

Score

300

Mentor

• @lzmhhh123

[AndrewDi]

@xiekeyi98 I found binary key length is short int type, so that KeyLen >= 65536 will overflow.

tidb/types/json/binary.go

Lines 191 to 195 in 4cbe896

	func (bj BinaryJSON) objectGetKey(i int) []byte {
	keyOff := int(endian.Uint32(bj.Value[headerSize+i*keyEntrySize:]))
	keyLen := int(endian.Uint16(bj.Value[headerSize+i*keyEntrySize+keyLenOff:]))
	return bj.Value[keyOff : keyOff+keyLen]
	}

I think we may need to change Length from unsigned int16 to unsigned int32 to resolve this problem, but this may affect the basic binary protocol.

[xiekeyi98]

@coocood PTAL, Thanks.

[ghost]

Confirming this issue still exists in master:

select json_object( REPEAT('a', 2 * 16 ), 1 );
select json_object( REPEAT('a', 64 * 1024), 1 );

..

mysql> select tidb_version()\G
*************************** 1. row ***************************
tidb_version(): Release Version: v4.0.0-beta.2-750-g8a661044c
Edition: Community
Git Commit Hash: 8a661044cedf8daad1de4fbf79a390962b6f6c3b
Git Branch: master
UTC Build Time: 2020-07-10 10:52:37
GoVersion: go1.13
Race Enabled: false
TiKV Min Version: v3.0.0-60965b006877ca7234adaced7890d7b029ed1306
Check Table Before Drop: false
1 row in set (0.00 sec)

mysql> 
mysql> select json_object( REPEAT('a', 2 * 16 ), 1 );
+-----------------------------------------+
| json_object( REPEAT('a', 2 * 16 ), 1 )  |
+-----------------------------------------+
| {"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa": 1} |
+-----------------------------------------+
1 row in set (0.00 sec)

mysql> select json_object( REPEAT('a', 64 * 1024), 1 );
+------------------------------------------+
| json_object( REPEAT('a', 64 * 1024), 1 ) |
+------------------------------------------+
| {"": 1}                                  |
+------------------------------------------+
1 row in set (0.00 sec)

[ti-srebot]

Please edit this comment or add a new comment to complete the following information

Not a bug

1. Remove the 'type/bug' label
2. Add notes to indicate why it is not a bug

Duplicate bug

1. Add the 'type/duplicate' label
2. Add the link to the original bug

Bug

Note: Make Sure that 'component', and 'severity' labels are added
Example for how to fill out the template: #20100

1. Root Cause Analysis (RCA) (optional)

2. Symptom (optional)

3. All Trigger Conditions (optional)

4. Workaround (optional)

5. Affected versions

6. Fixed versions