MDEV-39813 ST_GeomFromGeoJSON does not control recursion depth

mysql-test/main/disabled.def

@@ -16,4 +16,3 @@ mysql_embedded           : Bug#12561297 2011-05-14 Anitha Dependent on PB2 chang
 file_contents            : MDEV-6526 these files are not installed anymore
 max_statement_time       : cannot possibly work, depends on timing
 partition_open_files_limit : open_files_limit check broken by MDEV-18360
-gis-json                 : MDEV-39813 infinite recursion

mysql-test/main/gis-json.result

@@ -123,19 +123,6 @@ Warning	4048	Incorrect GeoJSON format specified for st_geomfromgeojson function.
 #
 # End of 10.2 tests
 #
-#
-# MDEV-39813 ST_GeomFromGeoJSON does not control recursion depth
-#
-SELECT ST_GeomFromGeoJSON(
-concat(
-repeat('{"type":"GeometryCollection","geometries":[', 2000),
-'{"type":"Point","coordinates":[0,0]}',
-repeat(']}', 2000)
-)) as exp;
-exp
-NULL
-Warnings:
-Warning	4040	Limit of 32 on JSON nested structures depth is reached in argument 1 to function 'st_geomfromgeojson' at position 473
 # End of 10.6 tests
 #
 # MDEV-34079: ST_AsGeoJSON returns incorrect value for empty geometry

mysql-test/main/gis-json.test

@@ -59,16 +59,6 @@ SELECT ST_ASTEXT(ST_GEOMFROMGEOJSON('{"type": ["POINT"], "coINates": [0,0] }'))
 --echo # End of 10.2 tests
 --echo #
 
---echo #
---echo # MDEV-39813 ST_GeomFromGeoJSON does not control recursion depth
---echo #
-
-SELECT ST_GeomFromGeoJSON(
-  concat(
-    repeat('{"type":"GeometryCollection","geometries":[', 2000),
-    '{"type":"Point","coordinates":[0,0]}',
-    repeat(']}', 2000)
-  )) as exp;
 
 --echo # End of 10.6 tests
 

mysql-test/main/lotofstack.result

@@ -104,3 +104,14 @@ drop table t3|
 #
 SELECT ST_GeomFromText(CONCAT(REPEAT('GEOMETRYCOLLECTION(',5000),'POINT(1 1)',REPEAT(')',5000)));
 # End of 10.6 tests
+#
+# MDEV-39813 ST_GeomFromGeoJSON does not control recursion depth
+#
+set @len = 3000;
+SELECT ST_GeomFromGeoJSON(
+concat(
+repeat('{"type":"GeometryCollection", "geometries":[', @len),
+'{"type":"Point","coordinates":[0,0]}',
+repeat(']}', @len)
+)) as exp;
+# End of 12.3 tests

mysql-test/main/lotofstack.test

@@ -148,3 +148,21 @@ SELECT ST_GeomFromText(CONCAT(REPEAT('GEOMETRYCOLLECTION(',5000),'POINT(1 1)',RE
 --enable_result_log
 
 --echo # End of 10.6 tests
+
+
+--echo #
+--echo # MDEV-39813 ST_GeomFromGeoJSON does not control recursion depth
+--echo #
+
+set @len = 3000;
+--disable_result_log
+--error ER_STACK_OVERRUN_NEED_MORE
+SELECT ST_GeomFromGeoJSON(
+  concat(
+    repeat('{"type":"GeometryCollection", "geometries":[', @len),
+    '{"type":"Point","coordinates":[0,0]}',
+    repeat(']}', @len)
+  )) as exp;
+--enable_result_log
+
+--echo # End of 12.3 tests

sql/spatial.cc

@@ -587,8 +587,10 @@ Geometry *Geometry::create_from_json(Geometry_buffer *buffer,
   uint key_len;
   int fcoll_type_found= 0, feature_type_found= 0;
 
+  if (check_stack_overrun(current_thd, STACK_MIN_SIZE , NULL))
+    return NULL;
+
   const uint32_t *killed_ptr= (uint32_t *) je->killed_ptr;
-  int stack_p;
 
   if (json_read_value(je))
     goto err_return;
@@ -754,10 +756,8 @@ Geometry *Geometry::create_from_json(Geometry_buffer *buffer,
 
 create_geom:
 
-  stack_p= je->stack_p;
   json_scan_start(je, je->s.cs, coord_start, je->s.str_end);
   je->killed_ptr= killed_ptr;
-  je->stack_p= stack_p;
 
   if (res->reserve(1 + 4, 512))
     goto err_return;
@@ -771,10 +771,8 @@ Geometry *Geometry::create_from_json(Geometry_buffer *buffer,
   return result;
 
 handle_geometry_key:
-  stack_p= je->stack_p;
   json_scan_start(je, je->s.cs, geometry_start, je->s.str_end);
   je->killed_ptr= killed_ptr;
-  je->stack_p= stack_p;
   return create_from_json(buffer, je, er_on_3D, res);
 
 err_return: