Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

jq segv in jv_array_set(jq-1.7.1/src/jv.c:997:3) #3262

Open
Ekkosun opened this issue Feb 17, 2025 · 1 comment
Open

jq segv in jv_array_set(jq-1.7.1/src/jv.c:997:3) #3262

Ekkosun opened this issue Feb 17, 2025 · 1 comment
Labels

Comments

@Ekkosun
Copy link

Ekkosun commented Feb 17, 2025

Describe the bug
jq SEGV on unknown address read access in jv_array_set(jq-1.7.1/src/jv.c:997:3)

To Reproduce
run command jq ".[54E100]=7" $poc

jq-poc.zip

Expected behavior
not crash with the input

Environment (please complete the following information):

  • OS and Version:
    Distributor ID: Ubuntu
    Description: Ubuntu 20.04.6 LTS
    Release: 20.04
    Codename: focal
  • jq version 1.7.1

Additional context
ASAN output
/tmp/jq-1.7.1/bins/bin/jq ".[54E100]=7" /tmp/poc
jq: error (at /tmp/poc:0): Cannot index number with number
AddressSanitizer:DEADLYSIGNAL

==2577859==ERROR: AddressSanitizer: SEGV on unknown address 0x60280000d6d0 (pc 0x564c6e1be8bb bp 0x7ffe288058b0 sp 0x7ffe28805640 T0)
==2577859==The signal is caused by a READ memory access.
#0 0x564c6e1be8bb in jv_array_set /tmp/jq-1.7.1/src/jv.c:997:3
#1 0x564c6e1e4eac in jv_set /tmp/jq-1.7.1/src/jv_aux.c:179:11
#2 0x564c6e1eaf0e in jv_setpath /tmp/jq-1.7.1/src/jv_aux.c:420:10
#3 0x564c6e2df3fa in f_setpath /tmp/jq-1.7.1/src/builtin.c:1246:62
#4 0x564c6e19918a in jq_next /tmp/jq-1.7.1/src/execute.c:918:21
#5 0x564c6e184145 in process /tmp/jq-1.7.1/src/main.c:200:31
#6 0x564c6e181d0e in main /tmp/jq-1.7.1/src/main.c:739:15
#7 0x7f5e91f45082 in __libc_start_main /build/glibc-FcRMwW/glibc-2.31/csu/../csu/libc-start.c:308:16
#8 0x564c6e0ba7cd in _start (/tmp/jq-1.7.1/bins/bin/jq+0x647cd) (BuildId: 8dcf56820b82446cfdfd28d1cdf9d48a6eeed42a)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /tmp/jq-1.7.1/src/jv.c:997:3 in jv_array_set
==2577859==ABORTING

@itchyny
Copy link
Contributor

itchyny commented Feb 17, 2025

This is also a duplicate report of GHSA-mhvp-p686-2667 and GHSA-26cx-w5c4-xmj6 (both are still private).

@itchyny itchyny added the dup label Feb 17, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants