Hi Sylvain, On 10/15/26 07:33, Sylvain Beucler wrote:
Hi,On Tue, Oct 13, 2026 at 02:41:40PM -0500, Simon Quigley wrote:Fair point about mixing the regression fix with new security fixes. Would you rather I keep them in, or drop them and ship just the regression fixes?No strong preference.And if they stay, should this go out as a new DLA instead of DLA-4662-2?Indeed.
Thanks! I'll keep the new security fixes and ship this as a new DLA.
CVE-2026-32316-2 explains why it is original; upstream's fix adds jv_string_repeat(), and that symbol would change the libjq1 ABI.OK, please keep Aron Xu's authorship header.
Sure, will do.
CVE-2026-47770-2 explains why there is no upstream series to pick. jv_delpaths() on master still does not check what jv_sort() returns.You also mention "Upstream still asserts on this input, so the patch is original." Do you mean we're fixing behavior that is unfixed upstream and/or unstable? We shouldn't divert that way.
On CVE-2026-47770, right, upstream still asserts in jv_delpaths() on this input. The fix I'm carrying is the same guard Trixie already shipped in 1.7.1-6+deb13u3 (DSA-6416-1), so Bookworm is catching up to Trixie, not going its own way. It also stops the abort that deb12u2 introduced after DLA-4662-1. I'm happy to reword the patch header to say that, or drop it if you don't think Trixie shipping this before unstable warrants including it. Best regards, Simon Quigley [email protected]
OpenPGP_signature.asc
Description: OpenPGP digital signature
