jv_setpath: fix leak when indexing an array with an array
arrays[arrays] is a special case of "INDEX" that actually returns an
array containing the indices in which the array that is being indexed
contains the start of the key array.
So array keys, for array values, are a kind of key that can be "got",
but not "set". jv_setpath() was not freeing the value it "got" from
indexing that key, in case the following "set" on that key failed,
resulting in a leak.
$ ./jq -n '[] | setpath([[1]]; 1)'
jq: error (at <unknown>): Cannot update field at array index of array
=================================================================
==953483==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 272 byte(s) in 1 object(s) allocated from:
#0 0x725f4d4e1359 in __interceptor_malloc /usr/src/debug/gcc/gcc/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x5ec17b1a7438 in jv_mem_alloc src/jv_alloc.c:141
SUMMARY: AddressSanitizer: 272 byte(s) leaked in 1 allocation(s).
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66061
This commit is contained in:
1 parent
afe0afaf06
commit
5bbd02f581
2 files changed
+8
No files matched your search
@@ -2169,3 +2169,10 @@ try ltrimstr("x") catch "x", try rtrimstr("x") catch "x" | "ok"
|
||||
["ko","endswith() requires string inputs"]
|
||||
["ok",""]
|
||||
["ko","endswith() requires string inputs"]
|
||||
|
||||
|
||||
# oss-fuzz #66061: setpath/2 leaks when indexing array with array
|
||||
|
||||
try ["OK", setpath([[1]]; 1)] catch ["KO", .]
|
||||
[]
|
||||
["KO","Cannot update field at array index of array"]
|
||||
Reference in new issue
Block a user