navigine/jq
1
0 Fork 0
mirror of https://github.com/jqlang/jq.git synced 2026-10-26 20:16:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

Randomize hash seed to mitigate hash collision DoS attacks

Browse Source 
The hash function used a fixed seed, allowing attackers to craft colliding keys
and cause O(n^2) object parsing performance. Initialize the seed from a random
source at process startup to prevent the attack. This fixes CVE-2026-40164.

Co-authored-by: Asaf Meizner <asafmeizner@gmail.com>
This commit is contained in:
itchynyandAsaf Meizner committed 2026-04-13 08:53:26 +09:00
1 parent 6374ae0bcd
commit 0c7d133c3c
2 files changed
+34 -2
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

configure.ac
+2
View File
@@ -149,6 +149,8 @@ AC_CHECK_MEMBER([struct tm.tm_gmtoff], [AC_DEFINE([HAVE_TM_TM_GMT_OFF],1,[Define
AC_CHECK_MEMBER([struct tm.__tm_gmtoff], [AC_DEFINE([HAVE_TM___TM_GMT_OFF],1,[Define to 1 if the system has the __tm_gmt_off field in struct tm])],
[], [[#include <time.h>]])
AC_FIND_FUNC([setlocale], [c], [#include <locale.h>], [0,0])
AC_FIND_FUNC([arc4random], [c], [#include <stdlib.h>], [])
AC_FIND_FUNC([getentropy], [c], [#include <unistd.h>], [0, 0])
dnl Figure out if we have the pthread functions we actually need
AC_FIND_FUNC_NO_LIBS([pthread_key_create], [], [#include <pthread.h>], [NULL, NULL])