diff --git a/CVE-2024-23337.patch b/CVE-2024-23337.patch new file mode 100644 index 0000000000000000000000000000000000000000..3e6216eee87a5fb73df2ca6e42f13705f5306f8e --- /dev/null +++ b/CVE-2024-23337.patch @@ -0,0 +1,212 @@ +From de21386681c0df0104a99d9d09db23a9b2a78b1e Mon Sep 17 00:00:00 2001 +From: itchyny +Date: Wed, 21 May 2025 07:45:00 +0900 +Subject: [PATCH] Fix signed integer overflow in jvp_array_write and + jvp_object_rehash + +This commit fixes signed integer overflow and SEGV issues on growing +arrays and objects. The size of arrays and objects is now limited to +`536870912` (`0x20000000`). This fixes CVE-2024-23337 and fixes #3262. +--- + src/jv.c | 45 ++++++++++++++++++++++++++++++++++++--------- + src/jv_aux.c | 9 +++++---- + tests/jq.test | 4 ++++ + 3 files changed, 45 insertions(+), 13 deletions(-) + +diff --git a/src/jv.c b/src/jv.c +index e26f74d..97d4e34 100644 +--- a/src/jv.c ++++ b/src/jv.c +@@ -997,6 +997,11 @@ jv jv_array_set(jv j, int idx, jv val) { + jv_free(val); + return jv_invalid_with_msg(jv_string("Out of bounds negative array index")); + } ++ if (idx > (INT_MAX >> 2) - jvp_array_offset(j)) { ++ jv_free(j); ++ jv_free(val); ++ return jv_invalid_with_msg(jv_string("Array index too large")); ++ } + // copy/free of val,j coalesced + jv* slot = jvp_array_write(&j, idx); + jv_free(*slot); +@@ -1016,6 +1021,7 @@ jv jv_array_concat(jv a, jv b) { + // FIXME: could be faster + jv_array_foreach(b, i, elem) { + a = jv_array_append(a, elem); ++ if (!jv_is_valid(a)) break; + } + jv_free(b); + return a; +@@ -1288,6 +1294,7 @@ jv jv_string_indexes(jv j, jv k) { + p = jstr; + while ((p = _jq_memmem(p, (jstr + jlen) - p, idxstr, idxlen)) != NULL) { + a = jv_array_append(a, jv_number(p - jstr)); ++ if (!jv_is_valid(a)) break; + p++; + } + } +@@ -1310,14 +1317,17 @@ jv jv_string_split(jv j, jv sep) { + + if (seplen == 0) { + int c; +- while ((jstr = jvp_utf8_next(jstr, jend, &c))) ++ while ((jstr = jvp_utf8_next(jstr, jend, &c))) { + a = jv_array_append(a, jv_string_append_codepoint(jv_string(""), c)); ++ if (!jv_is_valid(a)) break; ++ } + } else { + for (p = jstr; p < jend; p = s + seplen) { + s = _jq_memmem(p, jend - p, sepstr, seplen); + if (s == NULL) + s = jend; + a = jv_array_append(a, jv_string_sized(p, s - p)); ++ if (!jv_is_valid(a)) break; + // Add an empty string to denote that j ends on a sep + if (s + seplen == jend && seplen != 0) + a = jv_array_append(a, jv_string("")); +@@ -1335,8 +1345,10 @@ jv jv_string_explode(jv j) { + const char* end = i + len; + jv a = jv_array_sized(len); + int c; +- while ((i = jvp_utf8_next(i, end, &c))) ++ while ((i = jvp_utf8_next(i, end, &c))) { + a = jv_array_append(a, jv_number(c)); ++ if (!jv_is_valid(a)) break; ++ } + jv_free(j); + return a; + } +@@ -1610,10 +1622,13 @@ static void jvp_object_free(jv o) { + } + } + +-static jv jvp_object_rehash(jv object) { ++static int jvp_object_rehash(jv *objectp) { ++ jv object = *objectp; + assert(JVP_HAS_KIND(object, JV_KIND_OBJECT)); + assert(jvp_refcnt_unshared(object.u.ptr)); + int size = jvp_object_size(object); ++ if (size > INT_MAX >> 2) ++ return 0; + jv new_object = jvp_object_new(size * 2); + for (int i=0; ivalue; ++ *valpp = &slot->value; ++ return 1; + } + slot = jvp_object_add_slot(*object, key, bucket); + if (slot) { + slot->value = jv_invalid(); + } else { +- *object = jvp_object_rehash(*object); ++ if (!jvp_object_rehash(object)) { ++ *valpp = NULL; ++ return 0; ++ } + bucket = jvp_object_find_bucket(*object, key); + assert(!jvp_object_find_slot(*object, key, bucket)); + slot = jvp_object_add_slot(*object, key, bucket); + assert(slot); + slot->value = jv_invalid(); + } +- return &slot->value; ++ *valpp = &slot->value; ++ return 1; + } + + static int jvp_object_delete(jv* object, jv key) { +@@ -1775,7 +1796,11 @@ jv jv_object_set(jv object, jv key, jv value) { + assert(JVP_HAS_KIND(object, JV_KIND_OBJECT)); + assert(JVP_HAS_KIND(key, JV_KIND_STRING)); + // copy/free of object, key, value coalesced +- jv* slot = jvp_object_write(&object, key); ++ jv* slot; ++ if (!jvp_object_write(&object, key, &slot)) { ++ jv_free(object); ++ return jv_invalid_with_msg(jv_string("Object too big")); ++ } + jv_free(*slot); + *slot = value; + return object; +@@ -1800,6 +1825,7 @@ jv jv_object_merge(jv a, jv b) { + assert(JVP_HAS_KIND(a, JV_KIND_OBJECT)); + jv_object_foreach(b, k, v) { + a = jv_object_set(a, k, v); ++ if (!jv_is_valid(a)) break; + } + jv_free(b); + return a; +@@ -1819,6 +1845,7 @@ jv jv_object_merge_recursive(jv a, jv b) { + jv_free(elem); + a = jv_object_set(a, k, v); + } ++ if (!jv_is_valid(a)) break; + } + jv_free(b); + return a; +diff --git a/src/jv_aux.c b/src/jv_aux.c +index 6004799..bbe1c0d 100644 +--- a/src/jv_aux.c ++++ b/src/jv_aux.c +@@ -193,18 +193,19 @@ jv jv_set(jv t, jv k, jv v) { + if (slice_len < insert_len) { + // array is growing + int shift = insert_len - slice_len; +- for (int i = array_len - 1; i >= end; i--) { ++ for (int i = array_len - 1; i >= end && jv_is_valid(t); i--) { + t = jv_array_set(t, i + shift, jv_array_get(jv_copy(t), i)); + } + } else if (slice_len > insert_len) { + // array is shrinking + int shift = slice_len - insert_len; +- for (int i = end; i < array_len; i++) { ++ for (int i = end; i < array_len && jv_is_valid(t); i++) { + t = jv_array_set(t, i - shift, jv_array_get(jv_copy(t), i)); + } +- t = jv_array_slice(t, 0, array_len - shift); ++ if (jv_is_valid(t)) ++ t = jv_array_slice(t, 0, array_len - shift); + } +- for (int i=0; i < insert_len; i++) { ++ for (int i = 0; i < insert_len && jv_is_valid(t); i++) { + t = jv_array_set(t, start + i, jv_array_get(jv_copy(v), i)); + } + jv_free(v); +diff --git a/tests/jq.test b/tests/jq.test +index d052b22..22bfd3a 100644 +--- a/tests/jq.test ++++ b/tests/jq.test +@@ -198,6 +198,10 @@ null + [0,1,2] + [0,5,2] + ++try (.[999999999] = 0) catch . ++null ++"Array index too large" ++ + # + # Multiple outputs, iteration + # diff --git a/jq.spec b/jq.spec index 02a26b7229611717fe64c8fe60804d76169d310e..87dfd5069e83f880d4d5c427a48f8bb6359bb192 100644 --- a/jq.spec +++ b/jq.spec @@ -1,12 +1,13 @@ Name: jq Version: 1.7.1 -Release: 3 +Release: 4 Summary: A lightweight and flexible command-line JSON processor -License: MIT and ASL 2.0 and CC-BY-3.0 and GPLv3 -URL: http://stedolan.github.io/jq/ +License: MIT AND ICU AND CC-BY-3.0 +URL: https://jqlang.org/ Source0: https://github.com/jqlang/jq/releases/download/jq-%{version}/jq-%{version}.tar.gz Patch0: CVE-2024-53427-pre.patch Patch1: CVE-2024-53427.patch +Patch2: CVE-2024-23337.patch BuildRequires: make flex bison gcc chrpath oniguruma-devel %ifarch %{valgrind_arches} BuildRequires: valgrind @@ -25,12 +26,7 @@ Requires: jq = %{version}-%{release} %description devel Development files for jq. -%package help -Summary: Documentation for jq package -BuildArch: noarch - -%description help -Documentation for jq package. +%package_help %prep %autosetup -n jq-%{version} -p1 @@ -42,6 +38,9 @@ Documentation for jq package. %install %make_install %delete_la_and_a + +rm -fr %{buildroot}%{_docdir} + chrpath -d %{buildroot}%{_bindir}/%{name} %check @@ -51,18 +50,11 @@ make check %endif %endif -%post -/sbin/ldconfig - -%postun -/sbin/ldconfig - - %files +%license COPYING +%doc AUTHORS %{_bindir}/jq %{_libdir}/libjq.so.* -%{_datadir}/doc/jq/COPYING -%{_datadir}/doc/jq/AUTHORS %files devel %{_includedir}/*.h @@ -70,12 +62,13 @@ make check %{_libdir}/pkgconfig/libjq.pc %files help -%{_datadir}/man/man1/jq.1.gz -%{_datadir}/doc/jq/README.md -%{_datadir}/doc/jq/NEWS.md - +%doc README.md NEWS.md +%{_mandir}/man1/jq.1* %changelog +* Thu May 22 2025 Funda Wang - 1.7.1-4 +- fix CVE-2024-23337 + * Fri Mar 07 2025 yaoxin <1024769339@qq.com> - 1.7.1-3 - Fix CVE-2024-53427 diff --git a/jq.yaml b/jq.yaml index 4f22ed01b99d5373018bb66cbac2a2ccd503604e..e0b66800313d94826a82e019e22dcb6c1bdc4b42 100644 --- a/jq.yaml +++ b/jq.yaml @@ -1,4 +1,4 @@ version_control: github -src_repo: stedolan/jq -tag_prefix: jq- -seperator: . +src_repo: jqlang/jq +tag_prefix: ^jq- +separator: .