Merge pull request from GHSA-7hmr-442f-qc8j

The unit allocated for decNumberCompare was accidentally removed by
commit 680baeffeb (PR #2804)

This caused a stack overflow when comparing a nan with a payload of 1000
or more.

This bug was found by OSS-fuzz.
Ref: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64771
Fixes GHSA-7hmr-442f-qc8j

It also fixes 1e999999999 > 1e-1147483646   triggering UBSAN errors
Fixes #2968
This commit is contained in:
Emanuele Torre authored and GitHub committed 2023-12-13 20:17:17 +01:00
1 parent c5fd64ba97
commit c9a5156521
3 files changed
+14 -5

No files matched your search

+5
View File
@@ -594,6 +594,11 @@ if ! x=$($JQ -n "1 # foo$cr + 2") || [ "$x" != 1 ]; then
exit 1
fi
# CVE-2023-50268: No stack overflow comparing a nan with a large payload
$VALGRIND $Q $JQ '1 != .' <<\EOF >/dev/null
Nan4000
EOF
# Allow passing the inline jq script before -- #2919
if ! r=$($JQ --args -rn -- '$ARGS.positional[0]' bar) || [ "$r" != bar ]; then
echo "passing the inline script after -- didn't work"