From a5323a369c904b34d7e5c2c81d2066b81bcf6a6f Mon Sep 17 00:00:00 2001
From: itchyny <itchyny@cybozu.co.jp>
Date: Sat, 10 Oct 2026 21:29:56 +0900
Subject: [PATCH] Fix assertion failure on too many parameters in a nested
 function (#3663)

A call passing more than 4095 arguments at the start of a nested
function body aborted jq after reporting the compile errors, with
"Assertion failed: (nemb > 0 && sz > 0), function jv_mem_calloc" and
exit status 134.

Stop compiling a function before its bytecode is allocated when it has
compile errors, since the bytecode is only generated and used when
compilation succeeds. jq now prints the same compile errors followed by
"jq: 2 compile errors" and exits with status 3, as it does for other
compile errors, instead of crashing.
---
 src/compile.c |  8 +++++++-
 tests/shtest  | 14 ++++++++++++++
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/src/compile.c b/src/compile.c
index b925020a..e1780b9a 100644
--- a/src/compile.c
+++ b/src/compile.c
@@ -1306,12 +1306,18 @@ static int compile(struct bytecode* bc, block b, struct locfile* lf, jv args, jv
     bc->nsubfunctions = 0;
     bc->subfunctions = 0;
   }
+  if (errors) {
+    bc->code = 0;
+    bc->constants = jv_invalid();
+    block_free(b);
+    return errors;
+  }
   uint16_t* code = jv_mem_calloc(bc->codelen, sizeof(uint16_t));
   bc->code = code;
   pos = 0;
   jv constant_pool = jv_array();
   int maxvar = -1;
-  if (!errors) for (inst* curr = b.first; curr; curr = curr->next) {
+  for (inst* curr = b.first; curr; curr = curr->next) {
     const struct opcode_description* op = opcode_describe(curr->op);
     if (op->length == 0)
       continue;
diff --git a/tests/shtest b/tests/shtest
index cde88152..8f3e0f63 100755
--- a/tests/shtest
+++ b/tests/shtest
@@ -952,6 +952,20 @@ $JQ -nf $d/prog.jq 2> $d/out && {
 }
 diff $d/out $d/expected
 
+# Test 3: Too many function parameters in a nested function (issue #3661)
+echo "Testing function parameter limit in a nested function..."
+cat > $d/expected <<EOF
+jq: error: function has too many parameters (max 4095)
+jq: error: too many function parameters or local function definitions (max 4095)
+jq: 2 compile errors
+EOF
+$JQ -rn '"def g(\([range(4097) | "a\(.)"] | join(";"))): .; def f: g(\([range(4097)] | join(";"))); f"' > $d/prog.jq
+$JQ -nf $d/prog.jq 2> $d/out && {
+  echo "Expected compile error for too many parameters in a nested function"
+  exit 1
+}
+diff $d/out $d/expected
+
 # CVE-2026-33948: No NUL truncation in the JSON parser
 if printf '{}\x00{}' | $JQ >/dev/null 2> /dev/null; then
   printf 'Error expected but jq exited successfully\n' 1>&2