Skip to content

Commit b7b2b72

Browse files
committed
Fix panic in JSONB decoder on invalid version byte
Replace assert_eq! with proper error handling to prevent panic on untrusted database input. The Decode trait contract requires returning Result<T, Error>, but the assertion would cause a panic instead. This issue was discovered through fuzzing and can be triggered by: - Malformed JSONB data in the database - Database corruption - Future PostgreSQL versions with different JSONB formats The fix replaces the assertion with a conditional check that returns an appropriate error, maintaining the Decode trait contract and allowing applications to handle the error gracefully. Signed-off-by: Jared Reyes <jaredreyespt@gmail.com>
1 parent 7248f64 commit b7b2b72

File tree

1 file changed

+8
-5
lines changed

1 file changed

+8
-5
lines changed

sqlx-postgres/src/types/json.rs

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -85,11 +85,14 @@ where
8585
let mut buf = value.as_bytes()?;
8686

8787
if value.format() == PgValueFormat::Binary && value.type_info == PgTypeInfo::JSONB {
88-
assert_eq!(
89-
buf[0], 1,
90-
"unsupported JSONB format version {}; please open an issue",
91-
buf[0]
92-
);
88+
// Check JSONB version byte - PostgreSQL currently only supports version 1
89+
if buf[0] != 1 {
90+
return Err(format!(
91+
"unsupported JSONB format version {} (expected 1)",
92+
buf[0]
93+
)
94+
.into());
95+
}
9396

9497
buf = &buf[1..];
9598
}

0 commit comments

Comments
 (0)