Commit Graph
20 Commits
Author SHA1 Message Date
itchyny 63751f8a9f Fix signed-int overflow in tokenadd to prevent buffer overflow 2026-04-26 22:59:17 +09:00
itchynyandMattias Wadman 2f09060afa Fix out-of-bounds read in jv_parse_sized()
This fixes CVE-2026-39979.

Co-authored-by: Mattias Wadman <mattias.wadman@gmail.com>
2026-04-13 11:04:52 +09:00
Fabian Fleischer 2ad99a6c70 Pre-allocate tokenbuf for string parser (#3485)
Fixes #3483
2026-02-28 15:45:16 +01:00
itchyny f28720f699 Increase the maximum parsing depth for parsing JSON to 10000 (#3328)
This is the same limit as encoding/json in Go and should be sufficient for most use cases.
2025-05-30 20:19:34 +09:00
itchyny 96d19ca2ee Fix use of uninitialized value in check_literal (fix #3316) (#3324) 2025-05-18 08:06:54 +09:00
itchyny 70e72abea3 Fix compiler warning type-limits in found_string (ref #2911) (#3263)
Whether `char` has a sign is implementation dependent, and `c >= 0` may
result in a compiler warning. We can use bitwise operator to check
whether the character is a control character, regardless of the sign.
2025-02-18 07:52:58 +09:00
Matt Meyers 562d5c5222 Return error for string literal beginning with single quote (#2964)
In order for a string literal to be valid in JSON, the value must be
surrounded by double quotes.
2024-10-06 08:52:56 +09:00
Emanuele Torre c5fd64ba97 jv_parse: let decNumberFromString/strtod parse complex nans as a NaN
Before this patch (when using decNumber), "Nan123" was parsed as a NaN,
only if the first n was uppercase.
2023-12-13 20:14:31 +01:00
David Korczynski 4570c23720 jv_parse: refactor jv_parse_sized
Signed-off-by: David Korczynski <david@adalogics.com>
2023-11-28 20:36:59 +01:00
David Korczynski 44300e4310 Extend fuzzing set up
Adds a parse function ins `jv_parse.c` that enables parsing using custom
flags for the parser. This is then used by two fuzzers added as well.

This is to make sure fuzzing hits various code parts currently not
fuzzed, e.g. `stream_token`:
https://storage.googleapis.com/oss-fuzz-coverage/jq/reports/20231125/linux/src/jq/src/jv_parse.c.html#L241

Signed-off-by: David Korczynski <david@adalogics.com>
2023-11-28 20:36:59 +01:00
itchyny 07149397d1 Reject U+001F in string literals (fix #2909) 2023-09-26 12:53:44 -05:00
Emanuele Torre 3a1ba0c42d Only care about RS when parsing with --seq
RS should only only have special meaning when parsing json-seq.
Before this fix, RS was sometimes treated as a value terminator, causing
weird results.

Bug discovered by OSS fuzz.
Ref: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60835
2023-07-25 16:42:32 -05:00
Emanuele Torre 4b3090a9ab Make stream parser error when a non-empty object or array is used as key
Fixes #2463
2023-07-17 13:15:55 -05:00
Emanuele Torre 4b1ac7c95f Parse nan in JSON as NaN instead of triggering a parse error (#2712)
* Fix memory leak for has(nan)

jv_array_get() used to be responsible of freeing the input array, but
since b5c4c3d67d, it is no longer called
if the key is nan. We need to free it manually to avoid leaking the
array.

* Parse  nan  in JSON as NaN instead of triggering a parse error

Fixes #2021
2023-07-14 07:12:27 +09:00
Mattias Wadman dfd440f0de Setup path correctly after stream parsing a key:value object pair (#2642) 2023-07-05 04:23:52 +09:00
William Langford 74c44bc9a3 Add configure guards around literal jv_numbers
Allow building jq in a mode that doesn't use decnumber for benchmarking
purposes. decnumber support is enabled by default, and this option is
meant to be removed once we're happy with the performance.
2019-10-22 14:11:04 -04:00
Leonid S. Usov cf4b48c7ba Save literal value of the parsed number to preserve it for the output
Extend jv_number to use decNumber for storing number literals. Any math
operations on the numbers will truncate them to double precision.
Comparisons when both numbers are literal numbers will compare them
without truncation.

Delay conversion of numbers to doubles until a math operation is performed,
to preserve precision. A literal jv_number will only need conversion to
double once, and will reuse the resultant double on subsequent
conversions.

Outputting literal jv_numbers preserves the original precision.

Add strong pthread requirement to manage contexts/allocations for
converting numbers between their decNumber, string, and double formats.
2019-10-22 14:11:04 -04:00
W-Mark Kubacki fd4ae8304e Parse no deeper than MAX_PARSING_DEPTH
while true; do printf '{"deeper": '; done | jq .
2017-01-27 09:59:44 -06:00
Nicolas Williams 8eb1367ca4 Heap buffer overflow in tokenadd() (fix #105)
This was an off-by one: the NUL terminator byte was not allocated on
resize.  This was triggered by JSON-encoded numbers longer than 256
bytes.
2015-10-24 17:27:56 -05:00
David Tolnay 0c93eb3379 Move source files to src/ 2015-08-23 20:36:11 -07:00