mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-08-25 17:32:06 +00:00
Code Issues Projects Releases Wiki Activity

jq: Fix CVE-2026-54679

Browse Source 
This patch applies the upstream fix for CVE-2026-54679 as referenced
in [2], using the upstream commit identified in [1].

[1] https://github.com/jqlang/jq/commit/46d1da30944ce93dd671ac72b6513fc0eb747837
[2] https://github.com/jqlang/jq/security/advisories/GHSA-29gj-222p-j7vx

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Darsh Kelaiya
2026-07-21 02:39:38 -07:00
committed by Anuj Mittal
parent 6d3530d6a1
commit ce23e14868
2 changed files with 75 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-oe/recipes-devtools/jq/jq/CVE-2026-54679.patch
+74
View File
@@ -0,0 +1,74 @@
From c4f6b269e6d2178c74aac6e82c5285a90c9347a0 Mon Sep 17 00:00:00 2001
From: itchyny <itchyny@cybozu.co.jp>
Date: Tue, 16 Jun 2026 14:31:14 +0900
Subject: [PATCH] Tighten string length bounds and propagate invalid jv in
implode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The bound added in CVE-2026-32316 (e47e56d22) still allowed
`sizeof(jvp_string) + (currlen + len) * 2 + 1` to wrap `size_t` on
32-bit platforms. Tighten the threshold so the final allocation
fits in 32-bit `size_t`.
Also break out of `jv_string_implode` and `f_string_implode` once
`jv_string_append_codepoint` returns an invalid `jv`; otherwise the
next iteration triggers the assertion in `jvp_string_ptr` (or
invokes undefined behavior under `-DNDEBUG`).
Fixes CVE-2026-54679.
CVE: CVE-2026-54679
Upstream-Status: Backport [https://github.com/jqlang/jq/commit/46d1da30944ce93dd671ac72b6513fc0eb747837]
Backport Changes:
- Omitted the jv_string_repeat() bound change because this function is
not present in the Scarthgap jq source. The applicable
jvp_string_append(), jv_string_implode(), and f_string_implode()
security changes were retained unchanged.
Co-authored-by: Dirk Müller <dirk@dmllr.de>
(cherry picked from commit 46d1da30944ce93dd671ac72b6513fc0eb747837)
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
src/builtin.c | 1 +
src/jv.c | 3 ++-
2 files changed, 3 insertions(+), 1 deletion(-)
diff --git a/src/builtin.c b/src/builtin.c
index 08a8a98..46b9077 100644
--- a/src/builtin.c
+++ b/src/builtin.c
@@ -1264,6 +1264,7 @@ static jv f_string_implode(jq_state *jq, jv a) {
if (nv < 0 || nv > 0x10FFFF || (nv >= 0xD800 && nv <= 0xDFFF))
nv = 0xFFFD; // U+FFFD REPLACEMENT CHARACTER
s = jv_string_append_codepoint(s, nv);
+ if (!jv_is_valid(s)) break;
}
jv_free(a);
diff --git a/src/jv.c b/src/jv.c
index fe27168..6f79693 100644
--- a/src/jv.c
+++ b/src/jv.c
@@ -1175,7 +1175,7 @@ static uint32_t jvp_string_remaining_space(jvp_string* s) {
static jv jvp_string_append(jv string, const char* data, uint32_t len) {
jvp_string* s = jvp_string_ptr(string);
uint32_t currlen = jvp_string_length(s);
- if ((uint64_t)currlen + len >= INT_MAX) {
+ if ((uint64_t)currlen + len >= INT_MAX - sizeof(jvp_string) / 2) {
jv_free(string);
return jv_invalid_with_msg(jv_string("String too long"));
}
@@ -1435,6 +1435,7 @@ jv jv_string_implode(jv j) {
if (nv < 0 || nv > 0x10FFFF || (nv >= 0xD800 && nv <= 0xDFFF))
nv = 0xFFFD; // U+FFFD REPLACEMENT CHARACTER
s = jv_string_append_codepoint(s, nv);
+ if (!jv_is_valid(s)) break;
}
jv_free(j);
--
2.44.4
meta-oe/recipes-devtools/jq/jq_1.7.1.bb
+1
View File
@@ -28,6 +28,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/${BPN}-${PV}/${BPN}-${PV}.tar.gz \
file://CVE-2026-43895.patch \
file://CVE-2026-47770.patch \
file://CVE-2026-49839.patch \
file://CVE-2026-54679.patch \
"
SRC_URI[sha256sum] = "478c9ca129fd2e3443fe27314b455e211e0d8c60bc8ff7df703873deeee580c2"