Yu-Fu Fu 7122866869 Guard deep structural equality and comparison recursion (#3539) ...

jv_equal and jv_cmp overflows the C stack on deeply nested
input. Cap recursion at 10000 with -1 / INT_MIN sentinels;
operators that compose user expressions surface this as
"Equality check too deep" / "Comparison too deep".

Fixes CVE-2026-47770.

2026-05-22 20:07:16 +09:00

..

builtin.c

Guard deep structural equality and comparison recursion (#3539)

2026-05-22 20:07:16 +09:00

builtin.h

Constant fold all kinds of constants

2023-08-04 11:47:34 -05:00

builtin.jq

Use // instead of //= in from_entries definition (#3516)

2026-04-02 22:04:51 +09:00

bytecode.c

…

bytecode.h

builtin.c: typecheck builtin cfunctions in function_list

2024-12-01 11:49:44 +01:00

compile.c

Reject embedded NUL bytes in module import paths

2026-05-09 17:08:43 +09:00

compile.h

Reject embedded NUL bytes in module import paths

2026-05-09 17:08:43 +09:00

exec_stack.h

Fix signed-int overflow in stack_reallocate

2026-04-24 22:09:44 +09:00

execute.c

Fix use-after-free in args2obj() array argument path (#3498)

2026-03-09 17:30:08 +09:00

inject_errors.c

Remove all #define _GNU_SOURCE in source files

2023-07-24 15:44:29 +02:00

jq_parser.h

…

jq_test.c

Fix crashes and resource leaks in jq_testsuite (#3509)

2026-03-15 21:45:16 +09:00

jq.h

libjq: extern C for C++

2023-11-28 22:50:25 +01:00

jv_alloc.c

Fix warning: a function definition without a prototype is deprecated (#3259)

2025-05-07 21:25:32 +09:00

jv_alloc.h

Avoid zero-length calloc (#3280)

2025-03-04 22:33:51 +09:00

jv_aux.c

Guard deep structural equality and comparison recursion (#3539)

2026-05-22 20:07:16 +09:00

jv_dtoa_tsd.c

Use jv_mem_alloc to allocate dtoa_context in tsd_dtoa_context_get (#3356)

2025-06-30 07:27:24 +09:00

jv_dtoa_tsd.h

Fix warning: a function definition without a prototype is deprecated (#3259)

2025-05-07 21:25:32 +09:00

jv_dtoa.c

Fix whitespace in number parsing (#3195)

2025-05-29 04:11:00 +09:00

jv_dtoa.h

…

jv_file.c

Fix memory leaks and double frees (#3487)

2026-03-01 06:15:58 +09:00

jv_parse.c

Fix signed-int overflow in tokenadd to prevent buffer overflow

2026-04-26 22:59:17 +09:00

jv_print.c

Reject numeric literals longer than DEC_MAX_DIGITS (999999999)

2026-05-06 19:45:24 +09:00

jv_private.h

Rename jv_type_private.h to jv_private.h, move jvp_number_is_nan there

2023-08-13 14:16:02 +02:00

jv_thread.h

Cross compile for Linux, MacOS and Windows on CI (#2665)

2023-07-10 08:05:25 +09:00

jv_unicode.c

Add trim/0, ltrim/0 and rtrim/0 that trims leading and trailing whitespace (#3056)

2024-03-20 11:04:17 +01:00

jv_unicode.h

Add trim/0, ltrim/0 and rtrim/0 that trims leading and trailing whitespace (#3056)

2024-03-20 11:04:17 +01:00

jv_utf8_tables.h

…

jv.c

Guard deep structural equality and comparison recursion (#3539)

2026-05-22 20:07:16 +09:00

jv.h

Improve performance of repeating strings (#3272)

2025-03-04 22:13:55 +09:00

lexer.c

Support CRLF line breaks in filters (#3274)

2025-03-04 22:11:40 +09:00

lexer.h

Support CRLF line breaks in filters (#3274)

2025-03-04 22:11:40 +09:00

lexer.l

Support CRLF line breaks in filters (#3274)

2025-03-04 22:11:40 +09:00

libm.h

Remove non-standard pow10 filter in favor of exp10 (#3059)

2024-03-20 18:23:08 +09:00

linker.c

Detect circular module imports to prevent stack overflow

2026-05-11 20:41:38 +09:00

linker.h

…

locfile.c

Fix syntax error assertion failure (fix #3348) (#3350)

2025-06-17 15:25:46 +09:00

locfile.h

…

main.c

Fix NUL truncation in program files loaded with -f

2026-04-24 22:15:08 +09:00

opcode_list.h

Add ERRORK opcode to trigger constant errors

2023-08-04 11:47:34 -05:00

parser.c

Reject embedded NUL bytes in module import paths

2026-05-09 17:08:43 +09:00

parser.h

Constant fold all kinds of constants

2023-08-04 11:47:34 -05:00

parser.y

Reject embedded NUL bytes in module import paths

2026-05-09 17:08:43 +09:00

util.c

Fix NUL truncation in the JSON parser

2026-04-13 08:46:11 +09:00

util.h

Add strptime fallback not only for Windows

2024-04-18 01:38:29 +02:00