itchyny fb59f14910 Limit path depth to prevent stack overflow ...

Deeply nested path arrays can cause unbounded recursion in
`jv_setpath`, `jv_getpath`, and `jv_delpaths`, leading to
stack overflow. Add a depth limit of 10000 to match the
existing `tojson` depth limit. This fixes CVE-2026-33947.

2026-04-13 11:23:40 +09:00

..

builtin.c

Add runtime type checks to f_string_indexes

2026-04-08 21:43:46 +02:00

builtin.h

…

builtin.jq

Use // instead of //= in from_entries definition (#3516)

2026-04-02 22:04:51 +09:00

bytecode.c

…

bytecode.h

builtin.c: typecheck builtin cfunctions in function_list

2024-12-01 11:49:44 +01:00

compile.c

Limit number of function parameters and definitions to prevent SEGV (#3460)

2026-02-25 07:49:40 +09:00

compile.h

Fix warning: a function definition without a prototype is deprecated (#3259)

2025-05-07 21:25:32 +09:00

exec_stack.h

Remove undefined behavior caught by LLVM 10 UBSAN.

2023-10-08 12:32:22 -05:00

execute.c

Fix use-after-free in args2obj() array argument path (#3498)

2026-03-09 17:30:08 +09:00

inject_errors.c

…

jq_parser.h

…

jq_test.c

Fix crashes and resource leaks in jq_testsuite (#3509)

2026-03-15 21:45:16 +09:00

jq.h

libjq: extern C for C++

2023-11-28 22:50:25 +01:00

jv_alloc.c

Fix warning: a function definition without a prototype is deprecated (#3259)

2025-05-07 21:25:32 +09:00

jv_alloc.h

Avoid zero-length calloc (#3280)

2025-03-04 22:33:51 +09:00

jv_aux.c

Limit path depth to prevent stack overflow

2026-04-13 11:23:40 +09:00

jv_dtoa_tsd.c

Use jv_mem_alloc to allocate dtoa_context in tsd_dtoa_context_get (#3356)

2025-06-30 07:27:24 +09:00

jv_dtoa_tsd.h

Fix warning: a function definition without a prototype is deprecated (#3259)

2025-05-07 21:25:32 +09:00

jv_dtoa.c

Fix whitespace in number parsing (#3195)

2025-05-29 04:11:00 +09:00

jv_dtoa.h

…

jv_file.c

Fix memory leaks and double frees (#3487)

2026-03-01 06:15:58 +09:00

jv_parse.c

Fix out-of-bounds read in jv_parse_sized()

2026-04-13 11:04:52 +09:00

jv_print.c

Improve error message truncation with closing delimiters (#3478)

2026-02-25 08:14:23 +09:00

jv_private.h

Rename jv_type_private.h to jv_private.h, move jvp_number_is_nan there

2023-08-13 14:16:02 +02:00

jv_thread.h

…

jv_unicode.c

Add trim/0, ltrim/0 and rtrim/0 that trims leading and trailing whitespace (#3056)

2024-03-20 11:04:17 +01:00

jv_unicode.h

Add trim/0, ltrim/0 and rtrim/0 that trims leading and trailing whitespace (#3056)

2024-03-20 11:04:17 +01:00

jv_utf8_tables.h

…

jv.c

Randomize hash seed to mitigate hash collision DoS attacks

2026-04-13 08:53:26 +09:00

jv.h

Improve performance of repeating strings (#3272)

2025-03-04 22:13:55 +09:00

lexer.c

Support CRLF line breaks in filters (#3274)

2025-03-04 22:11:40 +09:00

lexer.h

Support CRLF line breaks in filters (#3274)

2025-03-04 22:11:40 +09:00

lexer.l

Support CRLF line breaks in filters (#3274)

2025-03-04 22:11:40 +09:00

libm.h

Remove non-standard pow10 filter in favor of exp10 (#3059)

2024-03-20 18:23:08 +09:00

linker.c

Fix crash when importing a module with errors twice (#3497)

2026-03-06 15:32:29 +09:00

linker.h

…

locfile.c

Fix syntax error assertion failure (fix #3348) (#3350)

2025-06-17 15:25:46 +09:00

locfile.h

…

main.c

Fix memory leaks and double frees (#3487)

2026-03-01 06:15:58 +09:00

opcode_list.h

…

parser.c

Improve error message truncation with closing delimiters (#3478)

2026-02-25 08:14:23 +09:00

parser.h

…

parser.y

Improve error message truncation with closing delimiters (#3478)

2026-02-25 08:14:23 +09:00

util.c

Fix NUL truncation in the JSON parser

2026-04-13 08:46:11 +09:00

util.h

Add strptime fallback not only for Windows

2024-04-18 01:38:29 +02:00