Emanuele Torre
5bbd02f581
arrays[arrays] is a special case of "INDEX" that actually returns an
array containing the indices in which the array that is being indexed
contains the start of the key array.
So array keys, for array values, are a kind of key that can be "got",
but not "set". jv_setpath() was not freeing the value it "got" from
indexing that key, in case the following "set" on that key failed,
resulting in a leak.
$ ./jq -n '[] | setpath([[1]]; 1)'
jq: error (at <unknown>): Cannot update field at array index of array
=================================================================
==953483==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 272 byte(s) in 1 object(s) allocated from:
#0 0x725f4d4e1359 in __interceptor_malloc /usr/src/debug/gcc/gcc/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x5ec17b1a7438 in jv_mem_alloc src/jv_alloc.c:141
SUMMARY: AddressSanitizer: 272 byte(s) leaked in 1 allocation(s).
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66061
jq
jq is a lightweight and flexible command-line JSON processor akin to sed,awk,grep, and friends for JSON data. It's written in portable C and has zero runtime dependencies, allowing you to easily slice, filter, map, and transform structured data.
Documentation
- Official Documentation: jqlang.github.io/jq
- Try jq Online: jqplay.org
Installation
Prebuilt Binaries
Download the latest releases from the GitHub release page.
Docker Image
Pull the jq image to start quickly with Docker.
Building from source
Dependencies
- libtool
- make
- automake
- autoconf
Instructions
git submodule update --init # if building from git to get oniguruma
autoreconf -i # if building from git
./configure --with-oniguruma=builtin
make -j8
make check
sudo make install
Build a statically linked version:
make LDFLAGS=-all-static
If you're not using the latest git version but instead building a released tarball (available on the release page), skip the autoreconf step, and flex or bison won't be needed.
Cross-Compilation
For details on cross-compilation, check out the GitHub Actions file and the cross-compilation wiki page.
Community & Support
- Questions & Help: Stack Overflow (jq tag)
- Chat & Community: Join us on Discord
- Wiki & Advanced Topics: Explore the Wiki
License
jq is released under the MIT License. jq's documentation is
licensed under the Creative Commons CC BY 3.0.
jq uses parts of the open source C library "decNumber", which is distributed
under ICU License