50 lines
1.7 KiB
Diff
50 lines
1.7 KiB
Diff
From d73a79035e1d24011a3363d52bf36b4eaea67aa6 Mon Sep 17 00:00:00 2001
|
|
From: itchyny <itchyny@cybozu.co.jp>
|
|
Date: Sat, 31 May 2025 11:46:40 +0900
|
|
Subject: [PATCH] Fix heap buffer overflow when formatting an empty string
|
|
|
|
The `jv_string_empty` did not properly null-terminate the string data,
|
|
which could lead to a heap buffer overflow. The test case of
|
|
GHSA-p7rr-28xf-3m5w (`0[""*0]`) was fixed by the commit dc849e9bb74a,
|
|
but another case (`0[[]|implode]`) was still vulnerable. This commit
|
|
ensures string data is properly null-terminated, and fixes CVE-2025-48060.
|
|
|
|
CVE: CVE-2025-48060
|
|
Upstream: https://github.com/LordGrimmauld/nixpkgs/blob/df21c79bfbb4d5ea50a49231bb8f91ab7afa051d/pkgs/by-name/jq/jq/0005-Fix-heap-buffer-overflow-when-formatting-an-empty-st.patch
|
|
Signed-off-by: Yuce Kurum <yuce.kurum@mind.be>
|
|
---
|
|
src/jv.c | 1 +
|
|
tests/jq.test | 4 ++++
|
|
2 files changed, 5 insertions(+)
|
|
|
|
diff --git a/src/jv.c b/src/jv.c
|
|
index 6e8cdd3..3303286 100644
|
|
--- a/src/jv.c
|
|
+++ b/src/jv.c
|
|
@@ -1121,6 +1121,7 @@ static jv jvp_string_empty_new(uint32_t length) {
|
|
jvp_string* s = jvp_string_alloc(length);
|
|
s->length_hashed = 0;
|
|
memset(s->data, 0, length);
|
|
+ s->data[length] = 0;
|
|
jv r = {JVP_FLAGS_STRING, 0, 0, 0, {&s->refcnt}};
|
|
return r;
|
|
}
|
|
diff --git a/tests/jq.test b/tests/jq.test
|
|
index 10b20e3..680706b 100644
|
|
--- a/tests/jq.test
|
|
+++ b/tests/jq.test
|
|
@@ -2042,6 +2042,10 @@ map(try implode catch .)
|
|
[123,["a"],[nan]]
|
|
["implode input must be an array","string (\"a\") can't be imploded, unicode codepoint needs to be numeric","number (null) can't be imploded, unicode codepoint needs to be numeric"]
|
|
|
|
+try 0[implode] catch .
|
|
+[]
|
|
+"Cannot index number with string \"\""
|
|
+
|
|
# walk
|
|
walk(.)
|
|
{"x":0}
|
|
--
|
|
2.49.0
|
|
|