Re: [oe] [meta-oe][wrynose][PATCH] jq: fix CVE-2026-39956

On Wed, Jul 29, 2026 at 3:31 PM Tugrul Kukul <[email protected]> wrote:
>
> From: Tugrul Kukul <[email protected]>
>
> Backport patch to fix CVE-2026-39956.
>
> References:
>   https://nvd.nist.gov/vuln/detail/CVE-2026-39956
>   https://www.cve.org/CVERecord?id=CVE-2026-39956
>   https://security-tracker.debian.org/tracker/CVE-2026-39956
>   https://osv.dev/list?q=CVE-2026-39956
>
> Upstream fix:
>   https://github.com/jqlang/jq/commit/fdf8ef0f0810e3d365cdd5160de43db46f57ed03 [nvd]
>
> Tested with ptest:
> Before: PASSED: 7, FAILED: 0, SKIPPED: 0
> After: PASSED: 7, FAILED: 0, SKIPPED: 0
>
> Signed-off-by: Tugrul Kukul <[email protected]>
> ---
>  .../jq/jq/CVE-2026-39956.patch                | 50 +++++++++++++++++++
>  meta-oe/recipes-devtools/jq/jq_1.8.1.bb       |  1 +
>  2 files changed, 51 insertions(+)
>  create mode 100644 meta-oe/recipes-devtools/jq/jq/CVE-2026-39956.patch
>
> diff --git a/meta-oe/recipes-devtools/jq/jq/CVE-2026-39956.patch b/meta-oe/recipes-devtools/jq/jq/CVE-2026-39956.patch
> new file mode 100644
> index 0000000000..da41b1168f
> --- /dev/null
> +++ b/meta-oe/recipes-devtools/jq/jq/CVE-2026-39956.patch
> @@ -0,0 +1,50 @@
> +From 8e7a4a3c01da36e0b9509b0e93a005649318e0f7 Mon Sep 17 00:00:00 2001
> +From: tlsbollei <[email protected]>
> +Date: Wed, 8 Apr 2026 21:43:46 +0200
> +Subject: [PATCH] Add runtime type checks to f_string_indexes
> +
> +This fixes CVE-2026-39956.

This is missing CVE: tag and your Signed-off-by. Please send v2.

> +---
> + src/builtin.c | 8 ++++++++
> + tests/jq.test | 9 +++++++++
> + 2 files changed, 17 insertions(+)
> +
> +diff --git a/src/builtin.c b/src/builtin.c
> +index 52fe77c..ac56f9f 100644
> +--- a/src/builtin.c
> ++++ b/src/builtin.c
> +@@ -1286,6 +1286,14 @@ static jv f_string_explode(jq_state *jq, jv a) {
> + }
> +
> + static jv f_string_indexes(jq_state *jq, jv a, jv b) {
> ++  if (jv_get_kind(a) != JV_KIND_STRING) {
> ++    jv_free(b);
> ++    return type_error(a, "cannot be searched, as it is not a string");
> ++  }
> ++  if (jv_get_kind(b) != JV_KIND_STRING) {
> ++    jv_free(a);
> ++    return type_error(b, "is not a string");
> ++  }
> +   return jv_string_indexes(a, b);
> + }
> +
> +diff --git a/tests/jq.test b/tests/jq.test
> +index 4ecf72f..07aa0cf 100644
> +--- a/tests/jq.test
> ++++ b/tests/jq.test
> +@@ -1520,6 +1520,15 @@ split("")
> + "xababababax"
> + [1,7,[1,3,5,7]]
> +
> ++# _strindices is used by indices/1 but is callable
> ++try _strindices("abc") catch .
> ++123
> ++"number (123) cannot be searched, as it is not a string"
> ++
> ++try _strindices(123) catch .
> ++"abc"
> ++"number (123) is not a string"
> ++
> + # trim
> + # \u000b is vertical tab (\v not supported by json)
> + map(trim), map(ltrim), map(rtrim)
> diff --git a/meta-oe/recipes-devtools/jq/jq_1.8.1.bb b/meta-oe/recipes-devtools/jq/jq_1.8.1.bb
> index b213e21c57..5d2a1be398 100644
> --- a/meta-oe/recipes-devtools/jq/jq_1.8.1.bb
> +++ b/meta-oe/recipes-devtools/jq/jq_1.8.1.bb
> @@ -27,6 +27,7 @@ SRC_URI = "git://github.com/jqlang/jq.git;protocol=https;branch=master;tag=jq-${
>             file://CVE-2026-43895.patch \
>             file://CVE-2026-49839.patch \
>             file://CVE-2026-54679.patch \
> +           file://CVE-2026-39956.patch \
>             "
>
>  inherit autotools ptest
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#128550): https://lists.openembedded.org/g/openembedded-devel/message/128550
> Mute This Topic: https://lists.openembedded.org/mt/120499649/3616702
> Group Owner: [email protected]
> Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [[email protected]]
> -=-=-=-=-=-=-=-=-=-=-=-
>