Re: [oe] [meta-oe][PATCH] jq: fix infinite loop in CVE-2026-47770 backport

On 2026-07-23 13:24, tugrul.kukul via lists.openembedded.org wrote:
> From: Tugrul Kukul <[email protected]>
> 
> The backport dropped the "j++" body of the delpaths_sorted() grouping
> loop while adding the "== 1" guard, turning "while (...) j++;" into an
> empty-bodied "while (...);". The index never advances, so any update
> that produces "empty" (which reaches _modify() -> delpaths()) hangs,
> e.g. "map_values(. // empty)" and ".a |= empty". This also hangs the jq
> ptest suite.
> 
> Restore the "j++" body while keeping the "== 1" guard.
> 
> Assisted-by: kiro:claude-opus-4.8
> Signed-off-by: Tugrul Kukul <[email protected]>
> ---
>   meta-oe/recipes-devtools/jq/jq/CVE-2026-47770.patch | 6 ++++--
>   1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/meta-oe/recipes-devtools/jq/jq/CVE-2026-47770.patch b/meta-oe/recipes-devtools/jq/jq/CVE-2026-47770.patch
> index 1d6664e842..9865de86cb 100644
> --- a/meta-oe/recipes-devtools/jq/jq/CVE-2026-47770.patch
> +++ b/meta-oe/recipes-devtools/jq/jq/CVE-2026-47770.patch
> @@ -13,6 +13,7 @@ Fixes CVE-2026-47770.
>   
>   Signed-off-by: Anton Skorup <[email protected]>
>   Upstream-Status: Backport [https://github.com/jqlang/jq/commit/7122866869960b55cea3646bc91334ef55787831]
> +Signed-off-by: Tugrul Kukul <[email protected]>
>   ---
>    src/builtin.c |  36 +++++++++++++++--
>    src/jv.c      |  46 +++++++++++++++++-----
> @@ -237,13 +238,14 @@ index 594a21f..a39f1f1 100644
>    static jv parse_slice(jv j, jv slice, int* pstart, int* pend) {
>      // Array slices
>      jv start_jv = jv_object_get(jv_copy(slice), jv_string("start"));
> -@@ -471,8 +489,7 @@ static jv delpaths_sorted(jv object, jv paths, int start) {
> +@@ -471,8 +489,8 @@ static jv delpaths_sorted(jv object, jv paths, int start) {
>        int delkey = jv_array_length(jv_array_get(jv_copy(paths), i)) == start + 1;
>        jv key = jv_array_get(jv_array_get(jv_copy(paths), i), start);
>        while (j < jv_array_length(jv_copy(paths)) &&
>   -           jv_equal(jv_copy(key), jv_array_get(jv_array_get(jv_copy(paths), j), start)))
>   -      j++;
> -+           jv_equal(jv_copy(key), jv_array_get(jv_array_get(jv_copy(paths), j), start)) == 1);
> ++           jv_equal(jv_copy(key), jv_array_get(jv_array_get(jv_copy(paths), j), start)) == 1)
> ++      j++;
>        // if i <= entry < j, then entry starts with key
>        if (delkey) {
>          // deleting this entire key, we don't care about any more specific deletions
> 
> 
> 
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#128417): https://lists.openembedded.org/g/openembedded-devel/message/128417
> Mute This Topic: https://lists.openembedded.org/mt/120408910/9950728
> Group Owner: [email protected]
> Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [[email protected]]
> -=-=-=-=-=-=-=-=-=-=-=-
> 
Hi,

The master jq recipe was upgraded to 1.8.2 in commit 64a7f6443a
("jq: upgrade 1.8.1 -> 1.8.2"), which already includes the upstream
fix for CVE-2026-47770 (commit 7122866). This backport is therefore
no longer needed on master.

Please drop this patch.

Best,
\Tugrul