[meta-oe][scarthgap][PATCH] jq: fix build regression from CVE-2026-43895 backport

Shubhanshu Mani Tripathi <[email protected]>
Newsgroups org.openembedded.lists.openembedded-devel
Message-ID <[email protected]>
The CVE-2026-43895 backport patches both the pre-generated src/parser.c
that jq ships (and builds, since maintainer-mode/bison is disabled) and
its source src/parser.y. Git orders the diff sections alphabetically, so
parser.c is applied before parser.y and parser.y ends up with a newer
mtime. make's implicit .y.c rule then treats the shipped parser.c as
stale and tries to regenerate it with bison; jq's overridden rule only
prints "NOT building parser.c!" and produces no file, so the build fails
with:

  cc1: fatal error: src/parser.c: No such file or directory

Reorder the backport so the src/parser.y hunk is applied before the
generated src/parser.c hunk. parser.c is then written last, is not older
than parser.y, and make uses the shipped parser as-is.

Signed-off-by: Shubhanshu Mani Tripathi <[email protected]>
---
 .../jq/jq/CVE-2026-43895.patch                | 73 ++++++++++---------
 1 file changed, 38 insertions(+), 35 deletions(-)

diff --git a/meta-oe/recipes-devtools/jq/jq/CVE-2026-43895.patch b/meta-oe/recipes-devtools/jq/jq/CVE-2026-43895.patch
index efde45c710..b21f7c2806 100644
--- a/meta-oe/recipes-devtools/jq/jq/CVE-2026-43895.patch
+++ b/meta-oe/recipes-devtools/jq/jq/CVE-2026-43895.patch
@@ -22,6 +22,9 @@ Backport Changes:
 - Limited parser.c to three import/include action changes.
   The newer grammar caused unrelated generated-parser churn.
   Keeping target numbering avoids unrelated generated changes.
+- Applied the src/parser.y hunk before the generated src/parser.c hunk.
+  Otherwise parser.y is newer and make regenerates parser.c with bison.
+  Bison is disabled here, so the shipped parser.c must stay the newest.
 
 (cherry picked from commit 9d223f153c3632a207fa071caaa6292da33ae361)
 Signed-off-by: Darsh Kelaiya <[email protected]>
@@ -29,8 +32,8 @@ Signed-off-by: Darsh Kelaiya <[email protected]>
  src/compile.c | 12 ++++++++----
  src/compile.h |  2 +-
  src/linker.c  |  6 +++++-
- src/parser.c  | 16 +++-------------
  src/parser.y  | 16 +++-------------
+ src/parser.c  | 16 +++-------------
  tests/shtest  | 17 +++++++++++++++++
  6 files changed, 37 insertions(+), 32 deletions(-)
 
@@ -97,6 +100,40 @@ index e7d1024..4b15008 100644
          gen_const(JV_OBJECT(
              jv_string("optional"), jv_true(),
              jv_string("search"), jv_string(home))));
+diff --git a/src/parser.y b/src/parser.y
+index 3d24689..2901cab 100644
+--- a/src/parser.y
++++ b/src/parser.y
+@@ -504,26 +504,16 @@ ImportWhat Exp ';' {
+ 
+ ImportWhat:
+ "import" ImportFrom "as" BINDING {
+-  jv v = block_const($2);
+-  // XXX Make gen_import take only blocks and the int is_data so we
+-  // don't have to free so much stuff here
+-  $$ = gen_import(jv_string_value(v), jv_string_value($4), 1);
++  $$ = gen_import(block_const($2), $4, 1);
+   block_free($2);
+-  jv_free($4);
+-  jv_free(v);
+ } |
+ "import" ImportFrom "as" IDENT {
+-  jv v = block_const($2);
+-  $$ = gen_import(jv_string_value(v), jv_string_value($4), 0);
++  $$ = gen_import(block_const($2), $4, 0);
+   block_free($2);
+-  jv_free($4);
+-  jv_free(v);
+ } |
+ "include" ImportFrom {
+-  jv v = block_const($2);
+-  $$ = gen_import(jv_string_value(v), NULL, 0);
++  $$ = gen_import(block_const($2), jv_invalid(), 0);
+   block_free($2);
+-  jv_free(v);
+ }
+ 
+ ImportFrom:
 diff --git a/src/parser.c b/src/parser.c
 index 0599db7..c50f2fb 100644
 --- a/src/parser.c
@@ -141,40 +178,6 @@ index 0599db7..c50f2fb 100644
  }
  #line 3116 "src/parser.c"
      break;
-diff --git a/src/parser.y b/src/parser.y
-index 3d24689..2901cab 100644
---- a/src/parser.y
-+++ b/src/parser.y
-@@ -504,26 +504,16 @@ ImportWhat Exp ';' {
- 
- ImportWhat:
- "import" ImportFrom "as" BINDING {
--  jv v = block_const($2);
--  // XXX Make gen_import take only blocks and the int is_data so we
--  // don't have to free so much stuff here
--  $$ = gen_import(jv_string_value(v), jv_string_value($4), 1);
-+  $$ = gen_import(block_const($2), $4, 1);
-   block_free($2);
--  jv_free($4);
--  jv_free(v);
- } |
- "import" ImportFrom "as" IDENT {
--  jv v = block_const($2);
--  $$ = gen_import(jv_string_value(v), jv_string_value($4), 0);
-+  $$ = gen_import(block_const($2), $4, 0);
-   block_free($2);
--  jv_free($4);
--  jv_free(v);
- } |
- "include" ImportFrom {
--  jv v = block_const($2);
--  $$ = gen_import(jv_string_value(v), NULL, 0);
-+  $$ = gen_import(block_const($2), jv_invalid(), 0);
-   block_free($2);
--  jv_free(v);
- }
- 
- ImportFrom:
 diff --git a/tests/shtest b/tests/shtest
 index 505d45d..4a5978c 100755
 --- a/tests/shtest
-- 
2.43.0
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.