navigine/jq
1
0 Fork 0
mirror of https://github.com/jqlang/jq.git synced 2026-10-30 10:06:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix NUL truncation in program files loaded with -f

Browse Source 
This fixes CVE-2026-41256.
This commit is contained in:
itchyny committed 2026-04-24 22:15:08 +09:00
1 parent 01b3cded76
commit 5a015deae3
2 files changed
+15
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/main.c
+8
View File
@@ -612,6 +612,14 @@ int main(int argc, char* argv[]) {
ret = JQ_ERROR_SYSTEM;
goto out;
}
int len = jv_string_length_bytes(jv_copy(data));
if ((size_t)len != strlen(jv_string_value(data))) {
fprintf(stderr, "jq: program file contains NUL bytes\n");
free(program_origin);
jv_free(data);
ret = JQ_ERROR_SYSTEM;
goto out;
}
jq_set_attr(jq, jv_string("PROGRAM_ORIGIN"), jq_realpath(jv_string(dirname(program_origin))));
ARGS = JV_OBJECT(jv_string("positional"), ARGS,
jv_string("named"), jv_copy(program_arguments));