From c6e041699d8cd31b97375a2596217aff2cfca85b Mon Sep 17 00:00:00 2001 From: itchyny Date: Sat, 31 May 2025 11:46:40 +0900 Subject: [PATCH] Fix heap buffer overflow when formatting an empty string The `jv_string_empty` did not properly null-terminate the string data, which could lead to a heap buffer overflow. The test case of GHSA-p7rr-28xf-3m5w (`0[""*0]`) was fixed by the commit dc849e9bb74a, but another case (`0[[]|implode]`) was still vulnerable. This commit ensures string data is properly null-terminated, and fixes CVE-2025-48060. --- src/jv.c | 1 + tests/jq.test | 4 ++++ 2 files changed, 5 insertions(+) diff --git a/src/jv.c b/src/jv.c index dfb24fa3..e4529a47 100644 --- a/src/jv.c +++ b/src/jv.c @@ -1148,6 +1148,7 @@ static jv jvp_string_empty_new(uint32_t length) { jvp_string* s = jvp_string_alloc(length); s->length_hashed = 0; memset(s->data, 0, length); + s->data[length] = 0; jv r = {JVP_FLAGS_STRING, 0, 0, 0, {&s->refcnt}}; return r; } diff --git a/tests/jq.test b/tests/jq.test index 17232418..7e04c166 100644 --- a/tests/jq.test +++ b/tests/jq.test @@ -2362,6 +2362,10 @@ map(try implode catch .) [123,["a"],[nan]] ["implode input must be an array","string (\"a\") can't be imploded, unicode codepoint needs to be numeric","number (null) can't be imploded, unicode codepoint needs to be numeric"] +try 0[implode] catch . +[] +"Cannot index number with string \"\"" + # walk walk(.) {"x":0}