Repository: duckdb/duckdb (language: python)

Issue:
Using both `hive_partitioning` and `hive_types` in `read_json_objects` intermittently segfaults
### What happens?

duckdb cli will intermittently segfault when using `read_json_objects` with `hive_partitioning = true` and defined `hive_types`.

Specifically the segfault is of type `EXC_BAD_ACCESS`, subtype `KERN_INVALID_ADDRESS at 0x0000000000000004`

The intermittency varies, however in my local testing running the supplied script will cause the issue on anything between 1-120 attempts at a query.

### To Reproduce

To reproduce:

- Install duckdb (in my case by using `brew install duckdb` on macOS)
- Create the following script in your editor, and run it.  It should run the problematic command repeatedly until it segfaults at which point it should say upon which attempt this occurred.
```sh
#!/bin/sh

mkdir "month=07"
echo '{ "hello": "there" }' > month=07/mytest.json

counter=1
until duckdb -s "select * from read_json_objects('./month=*/*.json', hive_partitioning = true, format = auto, hive_types = {'month': int}, filename = true ) where month = 7;" 
  [ $? -eq 139 ]
do counter=$((counter+1)) 
done

printf "segfaulted on try: $counter\n"
```

In the hopes of saving you some debug time, some additional info:

- The state occurs when both when running duckdb interactively or via `-s`.... I only use `-s` here to make repeat testing until a failure state easier
- The same issue seems to manifest with single JSON objects, and line delimited JSON files with multiple objects
- The issue manifests with all sorts of JSON content, the content in the above script is just to illustrate, it does not appear to be the problem.
- Using `hive_partitioning = true` but not setting `hive_types` does not seem to trigger the condition



### OS:

macOS 14.5 (23F79), arm64

### DuckDB Version:

v1.0.0 1f98600c2c

### DuckDB Client:

Native CLI Client

### Full Name:

Lee Brotherston

### Affiliation:

OpsHelmInc

### What is the latest build you tested with? If possible, we recommend testing with the latest nightly build.

I have tested with a stable release

### Did you include all relevant data sets for reproducing the issue?

Yes

### Did you include all code required to reproduce the issue?

- [X] Yes, I have

### Did you include all relevant configuration (e.g., CPU architecture, Python version, Linux distribution) to reproduce the issue?

- [X] Yes, I have
Using both `hive_partitioning` and `hive_types` in `read_json_objects` intermittently segfaults
### What happens?

duckdb cli will intermittently segfault when using `read_json_objects` with `hive_partitioning = true` and defined `hive_types`.

Specifically the segfault is of type `EXC_BAD_ACCESS`, subtype `KERN_INVALID_ADDRESS at 0x0000000000000004`

The intermittency varies, however in my local testing running the supplied script will cause the issue on anything between 1-120 attempts at a query.

### To Reproduce

To reproduce:

- Install duckdb (in my case by using `brew install duckdb` on macOS)
- Create the following script in your editor, and run it.  It should run the problematic command repeatedly until it segfaults at which point it should say upon which attempt this occurred.
```sh
#!/bin/sh

mkdir "month=07"
echo '{ "hello": "there" }' > month=07/mytest.json

counter=1
until duckdb -s "select * from read_json_objects('./month=*/*.json', hive_partitioning = true, format = auto, hive_types = {'month': int}, filename = true ) where month = 7;" 
  [ $? -eq 139 ]
do counter=$((counter+1)) 
done

printf "segfaulted on try: $counter\n"
```

In the hopes of saving you some debug time, some additional info:

- The state occurs when both when running duckdb interactively or via `-s`.... I only use `-s` here to make repeat testing until a failure state easier
- The same issue seems to manifest with single JSON objects, and line delimited JSON files with multiple objects
- The issue manifests with all sorts of JSON content, the content in the above script is just to illustrate, it does not appear to be the problem.
- Using `hive_partitioning = true` but not setting `hive_types` does not seem to trigger the condition



### OS:

macOS 14.5 (23F79), arm64

### DuckDB Version:

v1.0.0 1f98600c2c

### DuckDB Client:

Native CLI Client

### Full Name:

Lee Brotherston

### Affiliation:

OpsHelmInc

### What is the latest build you tested with? If possible, we recommend testing with the latest nightly build.

I have tested with a stable release

### Did you include all relevant data sets for reproducing the issue?

Yes

### Did you include all code required to reproduce the issue?

- [X] Yes, I have

### Did you include all relevant configuration (e.g., CPU architecture, Python version, Linux distribution) to reproduce the issue?

- [X] Yes, I have


Discussion / hints:
Thanks for the reproducer - it works great - and for the additional info. We'll take a look.
Thanks for the reproducer - it works great - and for the additional info. We'll take a look.

Fix patch:
diff --git a/extension/json/json_functions/read_json_objects.cpp b/extension/json/json_functions/read_json_objects.cpp
index 46d4e7982f88..7e97b64717b2 100644
--- a/extension/json/json_functions/read_json_objects.cpp
+++ b/extension/json/json_functions/read_json_objects.cpp
@@ -33,8 +33,9 @@ static void ReadJSONObjectsFunction(ClientContext &context, TableFunctionInput &
 
 	if (!gstate.names.empty()) {
 		// Create the strings without copying them
-		auto strings = FlatVector::GetData<string_t>(output.data[0]);
-		auto &validity = FlatVector::Validity(output.data[0]);
+		const auto col_idx = gstate.column_indices[0];
+		auto strings = FlatVector::GetData<string_t>(output.data[col_idx]);
+		auto &validity = FlatVector::Validity(output.data[col_idx]);
 		for (idx_t i = 0; i < count; i++) {
 			if (objects[i]) {
 				strings[i] = string_t(units[i].pointer, units[i].size);


Test patch:
diff --git a/data/json/13725/month=07/mytest.json b/data/json/13725/month=07/mytest.json
new file mode 100644
index 000000000000..e9d008e5d983
--- /dev/null
+++ b/data/json/13725/month=07/mytest.json
@@ -0,0 +1,1 @@
+{"hello": "there"}
diff --git a/test/sql/json/issues/issue13725.test b/test/sql/json/issues/issue13725.test
new file mode 100644
index 000000000000..62664f600995
--- /dev/null
+++ b/test/sql/json/issues/issue13725.test
@@ -0,0 +1,36 @@
+# name: test/sql/json/issues/issue13725.test
+# description: Test issue 13725 - Using both hive_partitioning and hive_types in read_json_objects intermittently segfaults
+# group: [issues]
+
+require json
+
+# path slashes
+require notwindows
+
+query III
+select *
+from read_json_objects('data/json/13725/month=*/*.json', hive_partitioning = true, format = auto, hive_types = {'month': int}, filename = true)
+where month = 7;
+----
+{"hello": "there"}	data/json/13725/month=07/mytest.json	7
+
+query I
+select count(*)
+from read_json_objects('data/json/13725/month=*/*.json', hive_partitioning = true, format = auto, hive_types = {'month': int}, filename = true)
+where month = 7;
+----
+1
+
+query III
+select *
+from read_json('data/json/13725/month=*/*.json', hive_partitioning = true, format = auto, hive_types = {'month': int}, filename = true)
+where month = 7;
+----
+there	data/json/13725/month=07/mytest.json	7
+
+query I
+select count(*)
+from read_json('data/json/13725/month=*/*.json', hive_partitioning = true, format = auto, hive_types = {'month': int}, filename = true)
+where month = 7;
+----
+1