Deeply nested path arrays can cause unbounded recursion in
`jv_setpath`, `jv_getpath`, and `jv_delpaths`, leading to
stack overflow. Add a depth limit of 10000 to match the
existing `tojson` depth limit. This fixes CVE-2026-33947.
The hash function used a fixed seed, allowing attackers to craft colliding keys
and cause O(n^2) object parsing performance. Initialize the seed from a random
source at process startup to prevent the attack. This fixes CVE-2026-40164.
Co-authored-by: Asaf Meizner <asafmeizner@gmail.com>
In `jvp_string_append`, the allocation size `(currlen + len) * 2` could
overflow `uint32_t` when `currlen + len` exceeds `INT_MAX`, causing a small
allocation followed by a large `memcpy`.
In `jvp_string_copy_replace_bad`, the output buffer size calculation
`length * 3 + 1` could overflow `uint32_t`, again resulting in a small
allocation followed by a large write.
Add overflow checks to both functions to return an error for strings
that would exceed `INT_MAX` in length. Fixes CVE-2026-32316.
I love jq :) So while updating the version we ship in Solaris I have
tried to modify stuff to make everything work out of the box. Just
```
autoreconf -fiv
./configure
gmake
gmake check
```
I also went ahead and created Solaris test action should you be
interested in having it too. The changes are not extensive and I have
tried to comment them nicely in each commit. Hopefully that's enough.
Thanks for jq!
If --disable-maintainer-mode is enabled, then the rules for generating
parser.[ch] and lexer.[ch] did nothing. This worked fine if the source
and build directories are the same as the pre-generated parser.c and
lexer.c files would suffice. However, if the build directory is not the
same as the source directory, then the rest of the Make rules expect
parser.[ch] and lexer.[ch] to have been created in the build directory
if their source files (parser.y and lexer.l) are newer than the target
files, which can happen in case the source is fetched using Git.
Avoid the problem by copying the files to the build directory if needed.
Co-authored-by: Peter Kjellerstedt <pkj@axis.com>
- Fix segfault when --skip/--take is the last argument.
- Fix FILE handle leak: opened test files were never closed.
- Support running multiple test files in one invocation.
Copy `kk` and `vk` before passing to jv_object_get(), which consumes
its arguments. Without copies, subsequent loop iterations read freed
memory (CWE-416) and post-loop jv_free() double-frees (CWE-415).
This bug was introduced in `b279713e` when array processing was hoisted
out of
the loop into locals without accounting for jv_object_get() semantics.
Fixes GHSA-gf4g-95wj-4q4r.
When a module fails to parse as a library, `load_library` cached the
invalid block. A second import/include of the same module would find
the cached invalid block and pass it to `block_bind_library`,
triggering the assertion failure. Skip caching the block when there
are parse errors to avoid this problem.
This commit improves performance by refactoring `@uri` and `@urid`
to pre-alloacte buffers and build the `jv` string at the end.
Also, this fixes `@urid` to prevent multi-byte UTF-8 corruption,
and to preserve embedded null bytes.
itchyny