[meta-OE][scarthgap][PATCH 4/4] jq: Fix CVE-2026-54679

From: Darsh Kelaiya <[email protected]>

This patch applies the upstream fix for CVE-2026-54679 as referenced
in [2], using the upstream commit identified in [1].

[1] https://github.com/jqlang/jq/commit/46d1da30944ce93dd671ac72b6513fc0eb747837
[2] https://github.com/jqlang/jq/security/advisories/GHSA-29gj-222p-j7vx

Signed-off-by: Darsh Kelaiya <[email protected]>
---
 .../jq/jq/CVE-2026-54679.patch                | 74 +++++++++++++++++++
 meta-oe/recipes-devtools/jq/jq_1.7.1.bb       |  1 +
 2 files changed, 75 insertions(+)
 create mode 100644 meta-oe/recipes-devtools/jq/jq/CVE-2026-54679.patch

diff --git a/meta-oe/recipes-devtools/jq/jq/CVE-2026-54679.patch b/meta-oe/recipes-devtools/jq/jq/CVE-2026-54679.patch
new file mode 100644
index 0000000000..20689e83c6
--- /dev/null
+++ b/meta-oe/recipes-devtools/jq/jq/CVE-2026-54679.patch
@@ -0,0 +1,74 @@
+From c4f6b269e6d2178c74aac6e82c5285a90c9347a0 Mon Sep 17 00:00:00 2001
+From: itchyny <[email protected]>
+Date: Tue, 16 Jun 2026 14:31:14 +0900
+Subject: [PATCH] Tighten string length bounds and propagate invalid jv in
+ implode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The bound added in CVE-2026-32316 (e47e56d22) still allowed
+`sizeof(jvp_string) + (currlen + len) * 2 + 1` to wrap `size_t` on
+32-bit platforms. Tighten the threshold so the final allocation
+fits in 32-bit `size_t`.
+
+Also break out of `jv_string_implode` and `f_string_implode` once
+`jv_string_append_codepoint` returns an invalid `jv`; otherwise the
+next iteration triggers the assertion in `jvp_string_ptr` (or
+invokes undefined behavior under `-DNDEBUG`).
+
+Fixes CVE-2026-54679.
+
+CVE: CVE-2026-54679
+Upstream-Status: Backport [https://github.com/jqlang/jq/commit/46d1da30944ce93dd671ac72b6513fc0eb747837]
+
+Backport Changes:
+- Omitted the jv_string_repeat() bound change because this function is
+  not present in the Scarthgap jq source. The applicable
+  jvp_string_append(), jv_string_implode(), and f_string_implode()
+  security changes were retained unchanged.
+
+Co-authored-by: Dirk Müller <[email protected]>
+(cherry picked from commit 46d1da30944ce93dd671ac72b6513fc0eb747837)
+Signed-off-by: Darsh Kelaiya <[email protected]>
+---
+ src/builtin.c | 1 +
+ src/jv.c      | 3 ++-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/src/builtin.c b/src/builtin.c
+index 08a8a98..46b9077 100644
+--- a/src/builtin.c
++++ b/src/builtin.c
+@@ -1264,6 +1264,7 @@ static jv f_string_implode(jq_state *jq, jv a) {
+     if (nv < 0 || nv > 0x10FFFF || (nv >= 0xD800 && nv <= 0xDFFF))
+       nv = 0xFFFD; // U+FFFD REPLACEMENT CHARACTER
+     s = jv_string_append_codepoint(s, nv);
++    if (!jv_is_valid(s)) break;
+   }
+ 
+   jv_free(a);
+diff --git a/src/jv.c b/src/jv.c
+index fe27168..6f79693 100644
+--- a/src/jv.c
++++ b/src/jv.c
+@@ -1175,7 +1175,7 @@ static uint32_t jvp_string_remaining_space(jvp_string* s) {
+ static jv jvp_string_append(jv string, const char* data, uint32_t len) {
+   jvp_string* s = jvp_string_ptr(string);
+   uint32_t currlen = jvp_string_length(s);
+-  if ((uint64_t)currlen + len >= INT_MAX) {
++  if ((uint64_t)currlen + len >= INT_MAX - sizeof(jvp_string) / 2) {
+     jv_free(string);
+     return jv_invalid_with_msg(jv_string("String too long"));
+   }
+@@ -1435,6 +1435,7 @@ jv jv_string_implode(jv j) {
+     if (nv < 0 || nv > 0x10FFFF || (nv >= 0xD800 && nv <= 0xDFFF))
+       nv = 0xFFFD; // U+FFFD REPLACEMENT CHARACTER
+     s = jv_string_append_codepoint(s, nv);
++    if (!jv_is_valid(s)) break;
+   }
+ 
+   jv_free(j);
+-- 
+2.44.4
+
diff --git a/meta-oe/recipes-devtools/jq/jq_1.7.1.bb b/meta-oe/recipes-devtools/jq/jq_1.7.1.bb
index 56ac5b2032..4327a25311 100644
--- a/meta-oe/recipes-devtools/jq/jq_1.7.1.bb
+++ b/meta-oe/recipes-devtools/jq/jq_1.7.1.bb
@@ -28,6 +28,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/${BPN}-${PV}/${BPN}-${PV}.tar.gz \
     file://CVE-2026-43895.patch \
     file://CVE-2026-47770.patch \
     file://CVE-2026-49839.patch \
+    file://CVE-2026-54679.patch \
     "
 SRC_URI[sha256sum] = "478c9ca129fd2e3443fe27314b455e211e0d8c60bc8ff7df703873deeee580c2"
 
-- 
2.35.6