pgsql: Make json{b}_populate_recordset() use the right tuple descriptor

Make json{b}_populate_recordset() use the right tuple descriptor.

json{b}_populate_recordset() used the tuple descriptor created from the
query-level AS clause without worrying about whether it matched the actual
input record type. If it didn't, that would usually result in a crash,
though disclosure of server memory contents seems possible as well, for a
skilled attacker capable of issuing crafted SQL commands. Instead, use
the query-supplied descriptor only when there is no input tuple to look at,
and otherwise get a tuple descriptor based on the input tuple's own type
marking. The core code will detect any type mismatch in the latter case.

Michael Paquier and Tom Lane, per a report from David Rowley.
Back-patch to 9.3 where this functionality was introduced.

Security: CVE-2017-15098

Branch
------
REL9_4_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/70846ee0597b4aabc11ffe252eb972de6f77a021

Modified Files
--------------
src/backend/utils/adt/jsonfuncs.c | 36 +++++++++++++++++++++++++-----------
src/test/regress/expected/json.out | 13 +++++++++++++
src/test/regress/expected/jsonb.out | 13 +++++++++++++
src/test/regress/sql/json.sql | 6 ++++++
src/test/regress/sql/jsonb.sql | 6 ++++++
5 files changed, 63 insertions(+), 11 deletions(-)