mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-08-25 17:32:06 +00:00
Code Issues Projects Releases Wiki Activity

jq: fix CVE-2026-39956

Browse Source 
Backport patch to fix CVE-2026-39956.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-39956
  https://www.cve.org/CVERecord?id=CVE-2026-39956
  https://security-tracker.debian.org/tracker/CVE-2026-39956
  https://osv.dev/list?q=CVE-2026-39956

Upstream fix:
  https://github.com/jqlang/jq/commit/fdf8ef0f0810e3d365cdd5160de43db46f57ed03 [nvd]

Tested with ptest:
Before: PASSED: 7, FAILED: 0, SKIPPED: 0
After: PASSED: 7, FAILED: 0, SKIPPED: 0

Signed-off-by: Tugrul Kukul <tugrul.kukul@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Tugrul Kukul
2026-07-29 09:31:23 +02:00
committed by Anuj Mittal
parent 3a6720afef
commit 65604c0d46
2 changed files with 56 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-oe/recipes-devtools/jq/jq/CVE-2026-39956.patch
+55
View File
@@ -0,0 +1,55 @@
From 04834a11ffb9f988643fe64480cfb8553ff498af Mon Sep 17 00:00:00 2001
From: tlsbollei <170938166+tlsbollei@users.noreply.github.com>
Date: Wed, 8 Apr 2026 21:43:46 +0200
Subject: [PATCH] Add runtime type checks to f_string_indexes
This fixes CVE-2026-39956.
CVE: CVE-2026-39956
Upstream-Status: Backport [https://github.com/jqlang/jq/commit/fdf8ef0f0810e3d365cdd5160de43db46f57ed03]
Signed-off-by: Tugrul Kukul <tugrul.kukul@est.tech>
---
src/builtin.c | 8 ++++++++
tests/jq.test | 9 +++++++++
2 files changed, 17 insertions(+)
diff --git a/src/builtin.c b/src/builtin.c
index 378be02..08b94ac 100644
--- a/src/builtin.c
+++ b/src/builtin.c
@@ -1215,6 +1215,14 @@ static jv f_string_explode(jq_state *jq, jv a) {
}
static jv f_string_indexes(jq_state *jq, jv a, jv b) {
+ if (jv_get_kind(a) != JV_KIND_STRING) {
+ jv_free(b);
+ return type_error(a, "cannot be searched, as it is not a string");
+ }
+ if (jv_get_kind(b) != JV_KIND_STRING) {
+ jv_free(a);
+ return type_error(b, "is not a string");
+ }
return jv_string_indexes(a, b);
}
diff --git a/tests/jq.test b/tests/jq.test
index 6d1518d..f867e25 100644
--- a/tests/jq.test
+++ b/tests/jq.test
@@ -1333,6 +1333,15 @@ split("")
"xababababax"
[1,7,[1,3,5,7]]
+# _strindices is used by indices/1 but is callable
+try _strindices("abc") catch .
+123
+"number (123) cannot be searched, as it is not a string"
+
+try _strindices(123) catch .
+"abc"
+"number (123) is not a string"
+
indices(1)
[0,1,1,2,3,4,1,5]
[1,2,6]
meta-oe/recipes-devtools/jq/jq_1.7.1.bb
+1
View File
@@ -29,6 +29,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/${BPN}-${PV}/${BPN}-${PV}.tar.gz \
file://CVE-2026-47770.patch \
file://CVE-2026-49839.patch \
file://CVE-2026-54679.patch \
file://CVE-2026-39956.patch \
"
SRC_URI[sha256sum] = "478c9ca129fd2e3443fe27314b455e211e0d8c60bc8ff7df703873deeee580c2"