navigine/jq
1
0 Fork 0
mirror of https://github.com/jqlang/jq.git synced 2026-10-28 08:05:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

Limit path depth to prevent stack overflow

Browse Source 
Deeply nested path arrays can cause unbounded recursion in
`jv_setpath`, `jv_getpath`, and `jv_delpaths`, leading to
stack overflow. Add a depth limit of 10000 to match the
existing `tojson` depth limit. This fixes CVE-2026-33947.
This commit is contained in:
itchyny committed 2026-04-13 11:23:40 +09:00
1 parent 2f09060afa
commit fb59f14910
2 files changed
+46
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/jv_aux.c
+21
View File
@@ -365,6 +365,10 @@ static jv jv_dels(jv t, jv keys) {
return t;
}
#ifndef MAX_PATH_DEPTH
#define MAX_PATH_DEPTH (10000)
#endif
jv jv_setpath(jv root, jv path, jv value) {
if (jv_get_kind(path) != JV_KIND_ARRAY) {
jv_free(value);
@@ -372,6 +376,12 @@ jv jv_setpath(jv root, jv path, jv value) {
jv_free(path);
return jv_invalid_with_msg(jv_string("Path must be specified as an array"));
}
if (jv_array_length(jv_copy(path)) > MAX_PATH_DEPTH) {
jv_free(value);
jv_free(root);
jv_free(path);
return jv_invalid_with_msg(jv_string("Path too deep"));
}
if (!jv_is_valid(root)){
jv_free(value);
jv_free(path);
@@ -424,6 +434,11 @@ jv jv_getpath(jv root, jv path) {
jv_free(path);
return jv_invalid_with_msg(jv_string("Path must be specified as an array"));
}
if (jv_array_length(jv_copy(path)) > MAX_PATH_DEPTH) {
jv_free(root);
jv_free(path);
return jv_invalid_with_msg(jv_string("Path too deep"));
}
if (!jv_is_valid(root)) {
jv_free(path);
return root;
@@ -502,6 +517,12 @@ jv jv_delpaths(jv object, jv paths) {
jv_free(elem);
return err;
}
if (jv_array_length(jv_copy(elem)) > MAX_PATH_DEPTH) {
jv_free(object);
jv_free(paths);
jv_free(elem);
return jv_invalid_with_msg(jv_string("Path too deep"));
}
jv_free(elem);
}
if (jv_array_length(jv_copy(paths)) == 0) {