[meta-OE][wrynose][PATCH 3/3] jq: Fix CVE-2026-54679

From: Darsh Kelaiya <[email protected]>

This patch applies the upstream fix for CVE-2026-54679 as referenced
in [2], using the upstream commit identified in [1].

[1] https://github.com/jqlang/jq/commit/46d1da30944ce93dd671ac72b6513fc0eb747837
[2] https://github.com/jqlang/jq/security/advisories/GHSA-29gj-222p-j7vx

Signed-off-by: Darsh Kelaiya <[email protected]>
---
 .../jq/jq/CVE-2026-54679.patch                | 77 +++++++++++++++++++
 meta-oe/recipes-devtools/jq/jq_1.8.1.bb       |  1 +
 2 files changed, 78 insertions(+)
 create mode 100644 meta-oe/recipes-devtools/jq/jq/CVE-2026-54679.patch

diff --git a/meta-oe/recipes-devtools/jq/jq/CVE-2026-54679.patch b/meta-oe/recipes-devtools/jq/jq/CVE-2026-54679.patch
new file mode 100644
index 0000000000..b4bcff8c75
--- /dev/null
+++ b/meta-oe/recipes-devtools/jq/jq/CVE-2026-54679.patch
@@ -0,0 +1,77 @@
+From 3750f018d4ecdcccdd11edc4830efb7adc511123 Mon Sep 17 00:00:00 2001
+From: itchyny <[email protected]>
+Date: Tue, 16 Jun 2026 14:31:14 +0900
+Subject: [PATCH 3/3] Tighten string length bounds and propagate invalid jv in
+ implode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The bound added in CVE-2026-32316 (e47e56d22) still allowed
+`sizeof(jvp_string) + (currlen + len) * 2 + 1` to wrap `size_t` on
+32-bit platforms. Tighten the threshold so the final allocation
+fits in 32-bit `size_t`.
+
+Also break out of `jv_string_implode` and `f_string_implode` once
+`jv_string_append_codepoint` returns an invalid `jv`; otherwise the
+next iteration triggers the assertion in `jvp_string_ptr` (or
+invokes undefined behavior under `-DNDEBUG`).
+
+Fixes CVE-2026-54679.
+
+CVE: CVE-2026-54679
+Upstream-Status: Backport [https://github.com/jqlang/jq/commit/46d1da30944ce93dd671ac72b6513fc0eb747837]
+
+Co-authored-by: Dirk Müller <[email protected]>
+(cherry picked from commit 46d1da30944ce93dd671ac72b6513fc0eb747837)
+Signed-off-by: Darsh Kelaiya <[email protected]>
+---
+ src/builtin.c | 1 +
+ src/jv.c      | 5 +++--
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/src/builtin.c b/src/builtin.c
+index 0463fca..eb91ac7 100644
+--- a/src/builtin.c
++++ b/src/builtin.c
+@@ -1396,6 +1396,7 @@ static jv f_string_implode(jq_state *jq, jv a) {
+     if (nv < 0 || nv > 0x10FFFF || (nv >= 0xD800 && nv <= 0xDFFF))
+       nv = 0xFFFD; // U+FFFD REPLACEMENT CHARACTER
+     s = jv_string_append_codepoint(s, nv);
++    if (!jv_is_valid(s)) break;
+   }
+ 
+   jv_free(a);
+diff --git a/src/jv.c b/src/jv.c
+index 4f48f04..76c70c2 100644
+--- a/src/jv.c
++++ b/src/jv.c
+@@ -1194,7 +1194,7 @@ static uint32_t jvp_string_remaining_space(jvp_string* s) {
+ static jv jvp_string_append(jv string, const char* data, uint32_t len) {
+   jvp_string* s = jvp_string_ptr(string);
+   uint32_t currlen = jvp_string_length(s);
+-  if ((uint64_t)currlen + len >= INT_MAX) {
++  if ((uint64_t)currlen + len >= INT_MAX - sizeof(jvp_string) / 2) {
+     jv_free(string);
+     return jv_invalid_with_msg(jv_string("String too long"));
+   }
+@@ -1369,7 +1369,7 @@ jv jv_string_repeat(jv j, int n) {
+   }
+   int len = jv_string_length_bytes(jv_copy(j));
+   int64_t res_len = (int64_t)len * n;
+-  if (res_len >= INT_MAX) {
++  if ((uint64_t)res_len >= INT_MAX - sizeof(jvp_string) / 2) {
+     jv_free(j);
+     return jv_invalid_with_msg(jv_string("Repeat string result too long"));
+   }
+@@ -1454,6 +1454,7 @@ jv jv_string_implode(jv j) {
+     if (nv < 0 || nv > 0x10FFFF || (nv >= 0xD800 && nv <= 0xDFFF))
+       nv = 0xFFFD; // U+FFFD REPLACEMENT CHARACTER
+     s = jv_string_append_codepoint(s, nv);
++    if (!jv_is_valid(s)) break;
+   }
+ 
+   jv_free(j);
+-- 
+2.53.0
+
diff --git a/meta-oe/recipes-devtools/jq/jq_1.8.1.bb b/meta-oe/recipes-devtools/jq/jq_1.8.1.bb
index 4bf8292ac0..b213e21c57 100644
--- a/meta-oe/recipes-devtools/jq/jq_1.8.1.bb
+++ b/meta-oe/recipes-devtools/jq/jq_1.8.1.bb
@@ -26,6 +26,7 @@ SRC_URI = "git://github.com/jqlang/jq.git;protocol=https;branch=master;tag=jq-${
            file://CVE-2026-44777.patch \
            file://CVE-2026-43895.patch \
            file://CVE-2026-49839.patch \
+           file://CVE-2026-54679.patch \
            "
 
 inherit autotools ptest
-- 
2.35.6