From: Darsh Kelaiya <[email protected]> This patch applies the upstream fix for CVE-2026-54679 as referenced in [2], using the upstream commit identified in [1].
[1] https://github.com/jqlang/jq/commit/46d1da30944ce93dd671ac72b6513fc0eb747837 [2] https://github.com/jqlang/jq/security/advisories/GHSA-29gj-222p-j7vx Signed-off-by: Darsh Kelaiya <[email protected]> --- .../jq/jq/CVE-2026-54679.patch | 77 +++++++++++++++++++ meta-oe/recipes-devtools/jq/jq_1.8.1.bb | 1 + 2 files changed, 78 insertions(+) create mode 100644 meta-oe/recipes-devtools/jq/jq/CVE-2026-54679.patch diff --git a/meta-oe/recipes-devtools/jq/jq/CVE-2026-54679.patch b/meta-oe/recipes-devtools/jq/jq/CVE-2026-54679.patch new file mode 100644 index 0000000000..b4bcff8c75 --- /dev/null +++ b/meta-oe/recipes-devtools/jq/jq/CVE-2026-54679.patch @@ -0,0 +1,77 @@ +From 3750f018d4ecdcccdd11edc4830efb7adc511123 Mon Sep 17 00:00:00 2001 +From: itchyny <[email protected]> +Date: Tue, 16 Jun 2026 14:31:14 +0900 +Subject: [PATCH 3/3] Tighten string length bounds and propagate invalid jv in + implode +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The bound added in CVE-2026-32316 (e47e56d22) still allowed +`sizeof(jvp_string) + (currlen + len) * 2 + 1` to wrap `size_t` on +32-bit platforms. Tighten the threshold so the final allocation +fits in 32-bit `size_t`. + +Also break out of `jv_string_implode` and `f_string_implode` once +`jv_string_append_codepoint` returns an invalid `jv`; otherwise the +next iteration triggers the assertion in `jvp_string_ptr` (or +invokes undefined behavior under `-DNDEBUG`). + +Fixes CVE-2026-54679. + +CVE: CVE-2026-54679 +Upstream-Status: Backport [https://github.com/jqlang/jq/commit/46d1da30944ce93dd671ac72b6513fc0eb747837] + +Co-authored-by: Dirk Müller <[email protected]> +(cherry picked from commit 46d1da30944ce93dd671ac72b6513fc0eb747837) +Signed-off-by: Darsh Kelaiya <[email protected]> +--- + src/builtin.c | 1 + + src/jv.c | 5 +++-- + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/src/builtin.c b/src/builtin.c +index 0463fca..eb91ac7 100644 +--- a/src/builtin.c ++++ b/src/builtin.c +@@ -1396,6 +1396,7 @@ static jv f_string_implode(jq_state *jq, jv a) { + if (nv < 0 || nv > 0x10FFFF || (nv >= 0xD800 && nv <= 0xDFFF)) + nv = 0xFFFD; // U+FFFD REPLACEMENT CHARACTER + s = jv_string_append_codepoint(s, nv); ++ if (!jv_is_valid(s)) break; + } + + jv_free(a); +diff --git a/src/jv.c b/src/jv.c +index 4f48f04..76c70c2 100644 +--- a/src/jv.c ++++ b/src/jv.c +@@ -1194,7 +1194,7 @@ static uint32_t jvp_string_remaining_space(jvp_string* s) { + static jv jvp_string_append(jv string, const char* data, uint32_t len) { + jvp_string* s = jvp_string_ptr(string); + uint32_t currlen = jvp_string_length(s); +- if ((uint64_t)currlen + len >= INT_MAX) { ++ if ((uint64_t)currlen + len >= INT_MAX - sizeof(jvp_string) / 2) { + jv_free(string); + return jv_invalid_with_msg(jv_string("String too long")); + } +@@ -1369,7 +1369,7 @@ jv jv_string_repeat(jv j, int n) { + } + int len = jv_string_length_bytes(jv_copy(j)); + int64_t res_len = (int64_t)len * n; +- if (res_len >= INT_MAX) { ++ if ((uint64_t)res_len >= INT_MAX - sizeof(jvp_string) / 2) { + jv_free(j); + return jv_invalid_with_msg(jv_string("Repeat string result too long")); + } +@@ -1454,6 +1454,7 @@ jv jv_string_implode(jv j) { + if (nv < 0 || nv > 0x10FFFF || (nv >= 0xD800 && nv <= 0xDFFF)) + nv = 0xFFFD; // U+FFFD REPLACEMENT CHARACTER + s = jv_string_append_codepoint(s, nv); ++ if (!jv_is_valid(s)) break; + } + + jv_free(j); +-- +2.53.0 + diff --git a/meta-oe/recipes-devtools/jq/jq_1.8.1.bb b/meta-oe/recipes-devtools/jq/jq_1.8.1.bb index 4bf8292ac0..b213e21c57 100644 --- a/meta-oe/recipes-devtools/jq/jq_1.8.1.bb +++ b/meta-oe/recipes-devtools/jq/jq_1.8.1.bb @@ -26,6 +26,7 @@ SRC_URI = "git://github.com/jqlang/jq.git;protocol=https;branch=master;tag=jq-${ file://CVE-2026-44777.patch \ file://CVE-2026-43895.patch \ file://CVE-2026-49839.patch \ + file://CVE-2026-54679.patch \ " inherit autotools ptest -- 2.35.6
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#128286): https://lists.openembedded.org/g/openembedded-devel/message/128286 Mute This Topic: https://lists.openembedded.org/mt/120363542/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
