itchyny 9761ceb7d6 Reject numeric literals longer than DEC_MAX_DIGITS (999999999) ...

A signed-int overflow in decNumber's D2U macro lets huge literals
write attacker-controlled bytes past a stack buffer. Cap the length
before calling decNumberFromString, and pre-slice long strings in
jv_dump_string_trunc so the resulting error message doesn't itself
allocate a multi-GiB buffer.

Fixes CVE-2026-43894.

2026-05-06 19:45:24 +09:00

..

builtin.c

Limit the containment check depth

2026-04-24 22:02:24 +09:00

builtin.h

Constant fold all kinds of constants

2023-08-04 11:47:34 -05:00

builtin.jq

Use // instead of //= in from_entries definition (#3516)

2026-04-02 22:04:51 +09:00

bytecode.c

Move source files to src/

2015-08-23 20:36:11 -07:00

bytecode.h

builtin.c: typecheck builtin cfunctions in function_list

2024-12-01 11:49:44 +01:00

compile.c

Limit number of function parameters and definitions to prevent SEGV (#3460)

2026-02-25 07:49:40 +09:00

compile.h

Fix warning: a function definition without a prototype is deprecated (#3259)

2025-05-07 21:25:32 +09:00

exec_stack.h

Fix signed-int overflow in stack_reallocate

2026-04-24 22:09:44 +09:00

execute.c

Fix use-after-free in args2obj() array argument path (#3498)

2026-03-09 17:30:08 +09:00

inject_errors.c

Remove all #define _GNU_SOURCE in source files

2023-07-24 15:44:29 +02:00

jq_parser.h

Move source files to src/

2015-08-23 20:36:11 -07:00

jq_test.c

Fix crashes and resource leaks in jq_testsuite (#3509)

2026-03-15 21:45:16 +09:00

jq.h

libjq: extern C for C++

2023-11-28 22:50:25 +01:00

jv_alloc.c

Fix warning: a function definition without a prototype is deprecated (#3259)

2025-05-07 21:25:32 +09:00

jv_alloc.h

Avoid zero-length calloc (#3280)

2025-03-04 22:33:51 +09:00

jv_aux.c

Limit path depth to prevent stack overflow

2026-04-13 11:23:40 +09:00

jv_dtoa_tsd.c

Use jv_mem_alloc to allocate dtoa_context in tsd_dtoa_context_get (#3356)

2025-06-30 07:27:24 +09:00

jv_dtoa_tsd.h

Fix warning: a function definition without a prototype is deprecated (#3259)

2025-05-07 21:25:32 +09:00

jv_dtoa.c

Fix whitespace in number parsing (#3195)

2025-05-29 04:11:00 +09:00

jv_dtoa.h

Move source files to src/

2015-08-23 20:36:11 -07:00

jv_file.c

Fix memory leaks and double frees (#3487)

2026-03-01 06:15:58 +09:00

jv_parse.c

Fix signed-int overflow in tokenadd to prevent buffer overflow

2026-04-26 22:59:17 +09:00

jv_print.c

Reject numeric literals longer than DEC_MAX_DIGITS (999999999)

2026-05-06 19:45:24 +09:00

jv_private.h

Rename jv_type_private.h to jv_private.h, move jvp_number_is_nan there

2023-08-13 14:16:02 +02:00

jv_thread.h

Cross compile for Linux, MacOS and Windows on CI (#2665)

2023-07-10 08:05:25 +09:00

jv_unicode.c

Add trim/0, ltrim/0 and rtrim/0 that trims leading and trailing whitespace (#3056)

2024-03-20 11:04:17 +01:00

jv_unicode.h

Add trim/0, ltrim/0 and rtrim/0 that trims leading and trailing whitespace (#3056)

2024-03-20 11:04:17 +01:00

jv_utf8_tables.h

Move source files to src/

2015-08-23 20:36:11 -07:00

jv.c

Reject numeric literals longer than DEC_MAX_DIGITS (999999999)

2026-05-06 19:45:24 +09:00

jv.h

Improve performance of repeating strings (#3272)

2025-03-04 22:13:55 +09:00

lexer.c

Support CRLF line breaks in filters (#3274)

2025-03-04 22:11:40 +09:00

lexer.h

Support CRLF line breaks in filters (#3274)

2025-03-04 22:11:40 +09:00

lexer.l

Support CRLF line breaks in filters (#3274)

2025-03-04 22:11:40 +09:00

libm.h

Remove non-standard pow10 filter in favor of exp10 (#3059)

2024-03-20 18:23:08 +09:00

linker.c

Fix crash when importing a module with errors twice (#3497)

2026-03-06 15:32:29 +09:00

linker.h

Move source files to src/

2015-08-23 20:36:11 -07:00

locfile.c

Fix syntax error assertion failure (fix #3348) (#3350)

2025-06-17 15:25:46 +09:00

locfile.h

Move source files to src/

2015-08-23 20:36:11 -07:00

main.c

Fix NUL truncation in program files loaded with -f

2026-04-24 22:15:08 +09:00

opcode_list.h

Add ERRORK opcode to trigger constant errors

2023-08-04 11:47:34 -05:00

parser.c

Improve error message truncation with closing delimiters (#3478)

2026-02-25 08:14:23 +09:00

parser.h

Constant fold all kinds of constants

2023-08-04 11:47:34 -05:00

parser.y

Improve error message truncation with closing delimiters (#3478)

2026-02-25 08:14:23 +09:00

util.c

Fix NUL truncation in the JSON parser

2026-04-13 08:46:11 +09:00

util.h

Add strptime fallback not only for Windows

2024-04-18 01:38:29 +02:00