From: Darsh Kelaiya <[email protected]> This patch applies the upstream fix for CVE-2026-49839 as referenced in [2], using the upstream commit identified in [1].
[1] https://github.com/jqlang/jq/commit/e987df0d463d85fd70825e042a082427e8275b86 [2] https://github.com/jqlang/jq/security/advisories/GHSA-cfh2-vwfq-qfmm Signed-off-by: Darsh Kelaiya <[email protected]> --- .../jq/jq/CVE-2026-49839.patch | 37 +++++++++++++++++++ meta-oe/recipes-devtools/jq/jq_1.8.1.bb | 1 + 2 files changed, 38 insertions(+) create mode 100644 meta-oe/recipes-devtools/jq/jq/CVE-2026-49839.patch diff --git a/meta-oe/recipes-devtools/jq/jq/CVE-2026-49839.patch b/meta-oe/recipes-devtools/jq/jq/CVE-2026-49839.patch new file mode 100644 index 0000000000..c5729fd4df --- /dev/null +++ b/meta-oe/recipes-devtools/jq/jq/CVE-2026-49839.patch @@ -0,0 +1,37 @@ +From d06aa59975de9c469bf77bab901999d446ec739d Mon Sep 17 00:00:00 2001 +From: itchyny <[email protected]> +Date: Mon, 8 Jun 2026 22:14:48 +0900 +Subject: [PATCH 2/3] Fix heap-buffer-overflow in raw file loading + +When `jv_string_append_buf` overflows the string length limit, +it returns an invalid `jv`; `jv_load_file` then re-entered it +on the invalid value and overran the heap. Break out of the loop +once the value is invalid. + +Fixes CVE-2026-49839. + +CVE: CVE-2026-49839 +Upstream-Status: Backport [https://github.com/jqlang/jq/commit/e987df0d463d85fd70825e042a082427e8275b86] + +(cherry picked from commit e987df0d463d85fd70825e042a082427e8275b86) +Signed-off-by: Darsh Kelaiya <[email protected]> +--- + src/jv_file.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/src/jv_file.c b/src/jv_file.c +index b10bcc0..40137c3 100644 +--- a/src/jv_file.c ++++ b/src/jv_file.c +@@ -57,6 +57,8 @@ jv jv_load_file(const char* filename, int raw) { + + if (raw) { + data = jv_string_append_buf(data, buf, n); ++ if (!jv_is_valid(data)) ++ break; + } else { + jv_parser_set_buf(parser, buf, n, !feof(file)); + jv value; +-- +2.53.0 + diff --git a/meta-oe/recipes-devtools/jq/jq_1.8.1.bb b/meta-oe/recipes-devtools/jq/jq_1.8.1.bb index 18a7093885..4bf8292ac0 100644 --- a/meta-oe/recipes-devtools/jq/jq_1.8.1.bb +++ b/meta-oe/recipes-devtools/jq/jq_1.8.1.bb @@ -25,6 +25,7 @@ SRC_URI = "git://github.com/jqlang/jq.git;protocol=https;branch=master;tag=jq-${ file://CVE-2026-43896.patch \ file://CVE-2026-44777.patch \ file://CVE-2026-43895.patch \ + file://CVE-2026-49839.patch \ " inherit autotools ptest -- 2.35.6
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#128285): https://lists.openembedded.org/g/openembedded-devel/message/128285 Mute This Topic: https://lists.openembedded.org/mt/120363541/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
