Guard deep structural equality and comparison recursion (#3539)

jv_equal and jv_cmp overflows the C stack on deeply nested
input. Cap recursion at 10000 with -1 / INT_MIN sentinels;
operators that compose user expressions surface this as
"Equality check too deep" / "Comparison too deep".

Fixes CVE-2026-47770.
This commit is contained in:
Yu-Fu Fu authored and GitHub committed 2026-05-22 20:07:16 +09:00
1 parent f58787c418
commit 7122866869
4 files changed
+180 -28

No files matched your search

+22
View File
@@ -2611,3 +2611,25 @@ null
try (reduce range(10001) as $_ ({}; {a: .}) as $x | $x * $x) catch .
null
"Object merge too deep"
# regression test for deep structural equality recursion
try ((reduce range(10001) as $_ ([]; [.])) as $x | (reduce range(10001) as $_ ([]; [.])) as $y | $x == $y) catch .
null
"Equality check too deep"
# regression tests for deep ordering comparisons
try ((reduce range(10001) as $_ ([]; [.])) as $x | [$x, $x] | sort) catch .
null
"Comparison too deep"
try ((reduce range(10001) as $_ ([]; [.])) as $x | [$x, $x] | unique) catch .
null
"Comparison too deep"
try ((reduce range(10001) as $_ ({}; {a: .})) as $x | [$x, $x] | sort) catch .
null
"Comparison too deep"
try ((reduce range(10001) as $_ ({}; {a: .})) as $x | [$x, $x] | unique) catch .
null
"Comparison too deep"