[meta-oe][PATCH] jq: fix infinite loop in CVE-2026-47770 backport

From: Tugrul Kukul <[email protected]>

The backport dropped the "j++" body of the delpaths_sorted() grouping
loop while adding the "== 1" guard, turning "while (...) j++;" into an
empty-bodied "while (...);". The index never advances, so any update
that produces "empty" (which reaches _modify() -> delpaths()) hangs,
e.g. "map_values(. // empty)" and ".a |= empty". This also hangs the jq
ptest suite.

Restore the "j++" body while keeping the "== 1" guard.

Assisted-by: kiro:claude-opus-4.8
Signed-off-by: Tugrul Kukul <[email protected]>
---
 meta-oe/recipes-devtools/jq/jq/CVE-2026-47770.patch | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/meta-oe/recipes-devtools/jq/jq/CVE-2026-47770.patch b/meta-oe/recipes-devtools/jq/jq/CVE-2026-47770.patch
index 1d6664e842..9865de86cb 100644
--- a/meta-oe/recipes-devtools/jq/jq/CVE-2026-47770.patch
+++ b/meta-oe/recipes-devtools/jq/jq/CVE-2026-47770.patch
@@ -13,6 +13,7 @@ Fixes CVE-2026-47770.
 
 Signed-off-by: Anton Skorup <[email protected]>
 Upstream-Status: Backport [https://github.com/jqlang/jq/commit/7122866869960b55cea3646bc91334ef55787831]
+Signed-off-by: Tugrul Kukul <[email protected]>
 ---
  src/builtin.c |  36 +++++++++++++++--
  src/jv.c      |  46 +++++++++++++++++-----
@@ -237,13 +238,14 @@ index 594a21f..a39f1f1 100644
  static jv parse_slice(jv j, jv slice, int* pstart, int* pend) {
    // Array slices
    jv start_jv = jv_object_get(jv_copy(slice), jv_string("start"));
-@@ -471,8 +489,7 @@ static jv delpaths_sorted(jv object, jv paths, int start) {
+@@ -471,8 +489,8 @@ static jv delpaths_sorted(jv object, jv paths, int start) {
      int delkey = jv_array_length(jv_array_get(jv_copy(paths), i)) == start + 1;
      jv key = jv_array_get(jv_array_get(jv_copy(paths), i), start);
      while (j < jv_array_length(jv_copy(paths)) &&
 -           jv_equal(jv_copy(key), jv_array_get(jv_array_get(jv_copy(paths), j), start)))
 -      j++;
-+           jv_equal(jv_copy(key), jv_array_get(jv_array_get(jv_copy(paths), j), start)) == 1);
++           jv_equal(jv_copy(key), jv_array_get(jv_array_get(jv_copy(paths), j), start)) == 1)
++      j++;
      // if i <= entry < j, then entry starts with key
      if (delkey) {
        // deleting this entire key, we don't care about any more specific deletions
-- 
2.34.1