Guard deep structural equality and comparison recursion (#3539)
jv_equal and jv_cmp overflows the C stack on deeply nested input. Cap recursion at 10000 with -1 / INT_MIN sentinels; operators that compose user expressions surface this as "Equality check too deep" / "Comparison too deep". Fixes CVE-2026-47770.
This commit is contained in:
1 parent
f58787c418
commit
7122866869
4 files changed
+180
-28
No files matched your search
@@ -2611,3 +2611,25 @@ null
|
||||
try (reduce range(10001) as $_ ({}; {a: .}) as $x | $x * $x) catch .
|
||||
null
|
||||
"Object merge too deep"
|
||||
|
||||
# regression test for deep structural equality recursion
|
||||
try ((reduce range(10001) as $_ ([]; [.])) as $x | (reduce range(10001) as $_ ([]; [.])) as $y | $x == $y) catch .
|
||||
null
|
||||
"Equality check too deep"
|
||||
|
||||
# regression tests for deep ordering comparisons
|
||||
try ((reduce range(10001) as $_ ([]; [.])) as $x | [$x, $x] | sort) catch .
|
||||
null
|
||||
"Comparison too deep"
|
||||
|
||||
try ((reduce range(10001) as $_ ([]; [.])) as $x | [$x, $x] | unique) catch .
|
||||
null
|
||||
"Comparison too deep"
|
||||
|
||||
try ((reduce range(10001) as $_ ({}; {a: .})) as $x | [$x, $x] | sort) catch .
|
||||
null
|
||||
"Comparison too deep"
|
||||
|
||||
try ((reduce range(10001) as $_ ({}; {a: .})) as $x | [$x, $x] | unique) catch .
|
||||
null
|
||||
"Comparison too deep"
|
||||
Reference in new issue
Block a user