diff --git a/pkgs/by-name/jq/jq/0001-Improve-performance-of-repeating-strings-3272.patch b/pkgs/by-name/jq/jq/0001-Improve-performance-of-repeating-strings-3272.patch index 5112b8c11bd4..90a9f5601b83 100644 --- a/pkgs/by-name/jq/jq/0001-Improve-performance-of-repeating-strings-3272.patch +++ b/pkgs/by-name/jq/jq/0001-Improve-performance-of-repeating-strings-3272.patch @@ -1,7 +1,7 @@ From c15fc903e00fdd3b460e64d5a6a540f944e1eca6 Mon Sep 17 00:00:00 2001 From: itchyny Date: Tue, 4 Mar 2025 22:13:55 +0900 -Subject: [PATCH 1/4] Improve performance of repeating strings (#3272) +Subject: [PATCH 1/5] Improve performance of repeating strings (#3272) This commit improves the performance of repeating strings, by copying the result string instead of the string being repeated. Also it adds diff --git a/pkgs/by-name/jq/jq/0002-fix-jv_number_value-should-cache-the-double-value-of.patch b/pkgs/by-name/jq/jq/0002-fix-jv_number_value-should-cache-the-double-value-of.patch index a493751bedbe..17da9af6ca41 100644 --- a/pkgs/by-name/jq/jq/0002-fix-jv_number_value-should-cache-the-double-value-of.patch +++ b/pkgs/by-name/jq/jq/0002-fix-jv_number_value-should-cache-the-double-value-of.patch @@ -1,7 +1,7 @@ From df0ddb83feb656230157f5bc9b7f34caef1f82be Mon Sep 17 00:00:00 2001 From: itchyny Date: Sun, 16 Feb 2025 22:08:36 +0900 -Subject: [PATCH 2/4] fix: `jv_number_value` should cache the double value of +Subject: [PATCH 2/5] fix: `jv_number_value` should cache the double value of literal numbers (#3245) The code of `jv_number_value` is intended to cache the double value of diff --git a/pkgs/by-name/jq/jq/0003-Reject-NaN-with-payload-while-parsing-JSON.patch b/pkgs/by-name/jq/jq/0003-Reject-NaN-with-payload-while-parsing-JSON.patch index 985301d8ab26..cf3135d2a3a3 100644 --- a/pkgs/by-name/jq/jq/0003-Reject-NaN-with-payload-while-parsing-JSON.patch +++ b/pkgs/by-name/jq/jq/0003-Reject-NaN-with-payload-while-parsing-JSON.patch @@ -1,7 +1,7 @@ From dfd25612454deacb6df47329787844795bf59821 Mon Sep 17 00:00:00 2001 From: itchyny Date: Wed, 5 Mar 2025 07:43:54 +0900 -Subject: [PATCH 3/4] Reject NaN with payload while parsing JSON +Subject: [PATCH 3/5] Reject NaN with payload while parsing JSON This commit drops support for parsing NaN with payload in JSON like `NaN123` and fixes CVE-2024-53427. Other JSON extensions like `NaN` and diff --git a/pkgs/by-name/jq/jq/0004-Fix-signed-integer-overflow-in-jvp_array_write-and-j.patch b/pkgs/by-name/jq/jq/0004-Fix-signed-integer-overflow-in-jvp_array_write-and-j.patch index 313eea14e05d..8a54eb3ad056 100644 --- a/pkgs/by-name/jq/jq/0004-Fix-signed-integer-overflow-in-jvp_array_write-and-j.patch +++ b/pkgs/by-name/jq/jq/0004-Fix-signed-integer-overflow-in-jvp_array_write-and-j.patch @@ -1,7 +1,7 @@ From dc65d5af447f266d8a4037551e028785aab31e04 Mon Sep 17 00:00:00 2001 From: itchyny Date: Wed, 21 May 2025 07:45:00 +0900 -Subject: [PATCH 4/4] Fix signed integer overflow in jvp_array_write and +Subject: [PATCH 4/5] Fix signed integer overflow in jvp_array_write and jvp_object_rehash This commit fixes signed integer overflow and SEGV issues on growing diff --git a/pkgs/by-name/jq/jq/0005-Fix-heap-buffer-overflow-when-formatting-an-empty-st.patch b/pkgs/by-name/jq/jq/0005-Fix-heap-buffer-overflow-when-formatting-an-empty-st.patch new file mode 100644 index 000000000000..219207f0fe23 --- /dev/null +++ b/pkgs/by-name/jq/jq/0005-Fix-heap-buffer-overflow-when-formatting-an-empty-st.patch @@ -0,0 +1,45 @@ +From d73a79035e1d24011a3363d52bf36b4eaea67aa6 Mon Sep 17 00:00:00 2001 +From: itchyny +Date: Sat, 31 May 2025 11:46:40 +0900 +Subject: [PATCH 5/5] Fix heap buffer overflow when formatting an empty string + +The `jv_string_empty` did not properly null-terminate the string data, +which could lead to a heap buffer overflow. The test case of +GHSA-p7rr-28xf-3m5w (`0[""*0]`) was fixed by the commit dc849e9bb74a, +but another case (`0[[]|implode]`) was still vulnerable. This commit +ensures string data is properly null-terminated, and fixes CVE-2025-48060. +--- + src/jv.c | 1 + + tests/jq.test | 4 ++++ + 2 files changed, 5 insertions(+) + +diff --git a/src/jv.c b/src/jv.c +index 6e8cdd3..3303286 100644 +--- a/src/jv.c ++++ b/src/jv.c +@@ -1121,6 +1121,7 @@ static jv jvp_string_empty_new(uint32_t length) { + jvp_string* s = jvp_string_alloc(length); + s->length_hashed = 0; + memset(s->data, 0, length); ++ s->data[length] = 0; + jv r = {JVP_FLAGS_STRING, 0, 0, 0, {&s->refcnt}}; + return r; + } +diff --git a/tests/jq.test b/tests/jq.test +index 10b20e3..680706b 100644 +--- a/tests/jq.test ++++ b/tests/jq.test +@@ -2042,6 +2042,10 @@ map(try implode catch .) + [123,["a"],[nan]] + ["implode input must be an array","string (\"a\") can't be imploded, unicode codepoint needs to be numeric","number (null) can't be imploded, unicode codepoint needs to be numeric"] + ++try 0[implode] catch . ++[] ++"Cannot index number with string \"\"" ++ + # walk + walk(.) + {"x":0} +-- +2.49.0 + diff --git a/pkgs/by-name/jq/jq/package.nix b/pkgs/by-name/jq/jq/package.nix index a0e2b25552e8..8e6928be7fbb 100644 --- a/pkgs/by-name/jq/jq/package.nix +++ b/pkgs/by-name/jq/jq/package.nix @@ -44,6 +44,11 @@ stdenv.mkDerivation rec { # CVE-2024-23337 # https://github.com/jqlang/jq/commit/de21386681c0df0104a99d9d09db23a9b2a78b1e ./0004-Fix-signed-integer-overflow-in-jvp_array_write-and-j.patch + + # CVE-2025-48060, part two + # Improve-performance-of-repeating-strings is only a partial fix + # https://github.com/jqlang/jq/commit/c6e041699d8cd31b97375a2596217aff2cfca85b + ./0005-Fix-heap-buffer-overflow-when-formatting-an-empty-st.patch ]; # https://github.com/jqlang/jq/issues/2871