mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-08-30 00:33:19 +00:00
Code Issues Projects Releases Wiki Activity

jq: Fix CVE-2026-54679

Browse Source 
This patch applies the upstream fix for CVE-2026-54679 as referenced
in [2], using the upstream commit identified in [1].

[1] https://github.com/jqlang/jq/commit/46d1da30944ce93dd671ac72b6513fc0eb747837
[2] https://github.com/jqlang/jq/security/advisories/GHSA-29gj-222p-j7vx

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Darsh Kelaiya
2026-07-20 10:59:41 -07:00
committed by Anuj Mittal
parent f2fafaf4eb
commit f4c7a41fda
2 changed files with 78 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-oe/recipes-devtools/jq/jq/CVE-2026-54679.patch
+77
View File
@@ -0,0 +1,77 @@
From 3750f018d4ecdcccdd11edc4830efb7adc511123 Mon Sep 17 00:00:00 2001
From: itchyny <itchyny@cybozu.co.jp>
Date: Tue, 16 Jun 2026 14:31:14 +0900
Subject: [PATCH 3/3] Tighten string length bounds and propagate invalid jv in
implode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The bound added in CVE-2026-32316 (e47e56d22) still allowed
`sizeof(jvp_string) + (currlen + len) * 2 + 1` to wrap `size_t` on
32-bit platforms. Tighten the threshold so the final allocation
fits in 32-bit `size_t`.
Also break out of `jv_string_implode` and `f_string_implode` once
`jv_string_append_codepoint` returns an invalid `jv`; otherwise the
next iteration triggers the assertion in `jvp_string_ptr` (or
invokes undefined behavior under `-DNDEBUG`).
Fixes CVE-2026-54679.
CVE: CVE-2026-54679
Upstream-Status: Backport [https://github.com/jqlang/jq/commit/46d1da30944ce93dd671ac72b6513fc0eb747837]
Co-authored-by: Dirk Müller <dirk@dmllr.de>
(cherry picked from commit 46d1da30944ce93dd671ac72b6513fc0eb747837)
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
src/builtin.c | 1 +
src/jv.c | 5 +++--
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/src/builtin.c b/src/builtin.c
index 0463fca..eb91ac7 100644
--- a/src/builtin.c
+++ b/src/builtin.c
@@ -1396,6 +1396,7 @@ static jv f_string_implode(jq_state *jq, jv a) {
if (nv < 0 || nv > 0x10FFFF || (nv >= 0xD800 && nv <= 0xDFFF))
nv = 0xFFFD; // U+FFFD REPLACEMENT CHARACTER
s = jv_string_append_codepoint(s, nv);
+ if (!jv_is_valid(s)) break;
}
jv_free(a);
diff --git a/src/jv.c b/src/jv.c
index 4f48f04..76c70c2 100644
--- a/src/jv.c
+++ b/src/jv.c
@@ -1194,7 +1194,7 @@ static uint32_t jvp_string_remaining_space(jvp_string* s) {
static jv jvp_string_append(jv string, const char* data, uint32_t len) {
jvp_string* s = jvp_string_ptr(string);
uint32_t currlen = jvp_string_length(s);
- if ((uint64_t)currlen + len >= INT_MAX) {
+ if ((uint64_t)currlen + len >= INT_MAX - sizeof(jvp_string) / 2) {
jv_free(string);
return jv_invalid_with_msg(jv_string("String too long"));
}
@@ -1369,7 +1369,7 @@ jv jv_string_repeat(jv j, int n) {
}
int len = jv_string_length_bytes(jv_copy(j));
int64_t res_len = (int64_t)len * n;
- if (res_len >= INT_MAX) {
+ if ((uint64_t)res_len >= INT_MAX - sizeof(jvp_string) / 2) {
jv_free(j);
return jv_invalid_with_msg(jv_string("Repeat string result too long"));
}
@@ -1454,6 +1454,7 @@ jv jv_string_implode(jv j) {
if (nv < 0 || nv > 0x10FFFF || (nv >= 0xD800 && nv <= 0xDFFF))
nv = 0xFFFD; // U+FFFD REPLACEMENT CHARACTER
s = jv_string_append_codepoint(s, nv);
+ if (!jv_is_valid(s)) break;
}
jv_free(j);
--
2.53.0
meta-oe/recipes-devtools/jq/jq_1.8.1.bb
+1
View File
@@ -26,6 +26,7 @@ SRC_URI = "git://github.com/jqlang/jq.git;protocol=https;branch=master;tag=jq-${
file://CVE-2026-44777.patch \
file://CVE-2026-43895.patch \
file://CVE-2026-49839.patch \
file://CVE-2026-54679.patch \
"
inherit autotools ptest