mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-07-26 19:47:17 +00:00
Code Issues Projects Releases Wiki Activity

jq: Fix CVE-2026-43896

Browse Source 
The upstream fix [3] is for a newer jq codebase. Debian has already
backported this fix in jq 1.8.1-7. Use the Debian patch [1], which fixes
this CVE as tracked in Debian bug #1136445 [2].

[1] https://sources.debian.org/src/jq/1.8.1-7/debian/patches/CVE-2026-43896.patch
[2] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1136445
[3] https://github.com/jqlang/jq/commit/532ccea6080ed6758f39fe9f6208a44b665023d2

Reference:
https://github.com/jqlang/jq/security/advisories/GHSA-mg96-6h3q-g846

Signed-off-by: Shubham Pushpkar <spushpka@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Shubham Pushpkar
2026-07-06 08:20:19 -07:00
committed by Anuj Mittal
parent febf27765f
commit 22b6fca850
2 changed files with 74 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-oe/recipes-devtools/jq/jq/CVE-2026-43896.patch
+73
View File
@@ -0,0 +1,73 @@
From 532ccea6080ed6758f39fe9f6208a44b665023d2 Mon Sep 17 00:00:00 2001
From: itchyny <itchyny@cybozu.co.jp>
Date: Tue, 5 May 2026 22:44:02 +0900
Subject: [PATCH] Limit recursive object merge depth to prevent stack overflow
This fixes CVE-2026-43896.
CVE: CVE-2026-43896
Upstream-Status: Backport [https://github.com/jqlang/jq/commit/532ccea6080ed6758f39fe9f6208a44b665023d2]
Backport Changes:
- Dropped the duplicate tests/jq.test hunk because Wrynose already carries
the same regression coverage in existing CVE-2026-47770.patch.
(cherry picked from commit 532ccea6080ed6758f39fe9f6208a44b665023d2)
Signed-off-by: Shubham Pushpkar <spushpka@cisco.com>
---
src/jv.c | 25 +++++++++++++++++++++++--
1 file changed, 23 insertions(+), 2 deletions(-)
diff --git a/src/jv.c b/src/jv.c
index 34573b8..b112757 100644
--- a/src/jv.c
+++ b/src/jv.c
@@ -1884,16 +1884,33 @@ jv jv_object_merge(jv a, jv b) {
return a;
}
-jv jv_object_merge_recursive(jv a, jv b) {
+#ifndef MAX_OBJECT_MERGE_DEPTH
+#define MAX_OBJECT_MERGE_DEPTH (10000)
+#endif
+
+static jv jvp_object_merge_recursive(jv a, jv b, int depth) {
assert(JVP_HAS_KIND(a, JV_KIND_OBJECT));
assert(JVP_HAS_KIND(b, JV_KIND_OBJECT));
+ if (depth > MAX_OBJECT_MERGE_DEPTH) {
+ jv_free(a);
+ jv_free(b);
+ return jv_invalid_with_msg(jv_string("Object merge too deep"));
+ }
+
jv_object_foreach(b, k, v) {
jv elem = jv_object_get(jv_copy(a), jv_copy(k));
if (jv_is_valid(elem) &&
JVP_HAS_KIND(elem, JV_KIND_OBJECT) &&
JVP_HAS_KIND(v, JV_KIND_OBJECT)) {
- a = jv_object_set(a, k, jv_object_merge_recursive(elem, v));
+ jv merged = jvp_object_merge_recursive(elem, v, depth + 1);
+ if (!jv_is_valid(merged)) {
+ jv_free(k);
+ jv_free(a);
+ jv_free(b);
+ return merged;
+ }
+ a = jv_object_set(a, k, merged);
} else {
jv_free(elem);
a = jv_object_set(a, k, v);
@@ -1904,6 +1921,10 @@ jv jv_object_merge_recursive(jv a, jv b) {
return a;
}
+jv jv_object_merge_recursive(jv a, jv b) {
+ return jvp_object_merge_recursive(a, b, 0);
+}
+
/*
* Object iteration (internal helpers)
*/
--
2.44.4
meta-oe/recipes-devtools/jq/jq_1.8.1.bb
+1
View File
@@ -22,6 +22,7 @@ SRC_URI = "git://github.com/jqlang/jq.git;protocol=https;branch=master;tag=jq-${
file://CVE-2026-41256.patch \
file://CVE-2026-41257.patch \
file://CVE-2026-43894.patch \
file://CVE-2026-43896.patch \
"
inherit autotools ptest