fix: return an error instead of panicking when scanning JSON into an unaddressable value

schema/scan.go

@@ -352,6 +352,9 @@ func scanJSON(dest reflect.Value, src any) error {
 	if src == nil {
 		return scanNull(dest)
 	}
+	if !dest.CanAddr() {
+		return fmt.Errorf("bun: Scan(nonaddressable %s)", dest.Type())
+	}
 
 	b, err := toBytes(src)
 	if err != nil {
@@ -365,6 +368,9 @@ func scanJSONUseNumber(dest reflect.Value, src any) error {
 	if src == nil {
 		return scanNull(dest)
 	}
+	if !dest.CanAddr() {
+		return fmt.Errorf("bun: Scan(nonaddressable %s)", dest.Type())
+	}
 
 	b, err := toBytes(src)
 	if err != nil {
@@ -531,6 +537,9 @@ func scanJSONIntoInterface(dest reflect.Value, src any) error {
 	}
 
 	dest = dest.Elem()
+	if !dest.CanAddr() {
+		return fmt.Errorf("bun: Scan(nonaddressable %s)", dest.Type())
+	}
 	if fn := Scanner(dest.Type()); fn != nil {
 		return fn(dest, src)
 	}

schema/scan_json_test.go

@@ -0,0 +1,36 @@
+package schema
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// Regression test for #1306: scanning JSON into a non-nil interface used to
+// panic on dest.Addr() because the interface element is not addressable. The
+// scan must fail with an error instead, so the query does not deadlock.
+func TestScanJSONUnaddressableInterface(t *testing.T) {
+	var value any = map[string]any{"a": float64(1)}
+	dest := reflect.ValueOf(&value).Elem()
+
+	fn := Scanner(dest.Type())
+	require.NotNil(t, fn)
+
+	require.NotPanics(t, func() {
+		err := fn(dest, []byte(`{"b":2}`))
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "nonaddressable")
+	})
+}
+
+func TestScanJSONAddressableMap(t *testing.T) {
+	var value map[string]any
+	dest := reflect.ValueOf(&value).Elem()
+
+	fn := Scanner(dest.Type())
+	require.NotNil(t, fn)
+
+	require.NoError(t, fn(dest, []byte(`{"b":2}`)))
+	require.Equal(t, map[string]any{"b": float64(2)}, value)
+}