diff mbox series

[meta-oe] jq: fix infinite loop in CVE-2026-47770 backport

Message ID 20260723112419.73941-1-tugrul.kukul@est.tech
State New
Headers show
Series [meta-oe] jq: fix infinite loop in CVE-2026-47770 backport | expand

Commit Message

tugrul.kukul@est.tech July 23, 2026, 11:24 a.m. UTC 
From: Tugrul Kukul <tugrul.kukul@est.tech>

The backport dropped the "j++" body of the delpaths_sorted() grouping
loop while adding the "== 1" guard, turning "while (...) j++;" into an
empty-bodied "while (...);". The index never advances, so any update
that produces "empty" (which reaches _modify() -> delpaths()) hangs,
e.g. "map_values(. // empty)" and ".a |= empty". This also hangs the jq
ptest suite.

Restore the "j++" body while keeping the "== 1" guard.

Assisted-by: kiro:claude-opus-4.8
Signed-off-by: Tugrul Kukul <tugrul.kukul@est.tech>
---
 meta-oe/recipes-devtools/jq/jq/CVE-2026-47770.patch | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)
diff mbox series

Patch

diff --git a/meta-oe/recipes-devtools/jq/jq/CVE-2026-47770.patch b/meta-oe/recipes-devtools/jq/jq/CVE-2026-47770.patch
index 1d6664e842..9865de86cb 100644
--- a/meta-oe/recipes-devtools/jq/jq/CVE-2026-47770.patch
+++ b/meta-oe/recipes-devtools/jq/jq/CVE-2026-47770.patch
@@ -13,6 +13,7 @@  Fixes CVE-2026-47770.
 
 Signed-off-by: Anton Skorup <antonsk@axis.com>
 Upstream-Status: Backport [https://github.com/jqlang/jq/commit/7122866869960b55cea3646bc91334ef55787831]
+Signed-off-by: Tugrul Kukul <tugrul.kukul@est.tech>
 ---
  src/builtin.c |  36 +++++++++++++++--
  src/jv.c      |  46 +++++++++++++++++-----
@@ -237,13 +238,14 @@  index 594a21f..a39f1f1 100644
  static jv parse_slice(jv j, jv slice, int* pstart, int* pend) {
    // Array slices
    jv start_jv = jv_object_get(jv_copy(slice), jv_string("start"));
-@@ -471,8 +489,7 @@ static jv delpaths_sorted(jv object, jv paths, int start) {
+@@ -471,8 +489,8 @@ static jv delpaths_sorted(jv object, jv paths, int start) {
      int delkey = jv_array_length(jv_array_get(jv_copy(paths), i)) == start + 1;
      jv key = jv_array_get(jv_array_get(jv_copy(paths), i), start);
      while (j < jv_array_length(jv_copy(paths)) &&
 -           jv_equal(jv_copy(key), jv_array_get(jv_array_get(jv_copy(paths), j), start)))
 -      j++;
-+           jv_equal(jv_copy(key), jv_array_get(jv_array_get(jv_copy(paths), j), start)) == 1);
++           jv_equal(jv_copy(key), jv_array_get(jv_array_get(jv_copy(paths), j), start)) == 1)
++      j++;
      // if i <= entry < j, then entry starts with key
      if (delkey) {
        // deleting this entire key, we don't care about any more specific deletions