29 lines
839 B
Diff
29 lines
839 B
Diff
From: =?utf-8?b?IkNoYW5nWmh1byBDaGVuICjpmbPmmIzlgKwpIg==?=
|
|
<czchen@debian.org>
|
|
Date: Sat, 12 Apr 2025 15:58:51 +0800
|
|
Subject: Reject NaN with payload while parsing JSON
|
|
|
|
CVE: CVE-2024-53427
|
|
Upstream: https://sources.debian.org/src/jq/1.7.1-6/debian/patches/CVE-2024-53427.patch/
|
|
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
|
|
---
|
|
src/jv.c | 5 +++++
|
|
1 file changed, 5 insertions(+)
|
|
|
|
diff --git a/src/jv.c b/src/jv.c
|
|
index e23d8ec..7f798d8 100644
|
|
--- a/src/jv.c
|
|
+++ b/src/jv.c
|
|
@@ -586,6 +586,11 @@ static jv jvp_literal_number_new(const char * literal) {
|
|
n->num_double = NAN;
|
|
|
|
if (ctx->status & DEC_Conversion_syntax) {
|
|
+ // Reject NaN with payload.
|
|
+ if (n->num_decimal.digits > 1 || *n->num_decimal.lsu != 0) {
|
|
+ jv_mem_free(n);
|
|
+ return JV_INVALID;
|
|
+ }
|
|
jv_mem_free(n);
|
|
return JV_INVALID;
|
|
}
|