Skip to content
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Commit ba1e884

Browse files
committedOct 21, 2023
Fix possible uninitialised value dereference if jq_init() fails
If jq_init() fails, goto out would try to free input_state which is uninitialised. I initialised input_state to NULL to fix the problem. I also fixed input_jq_util_input_init() not handling OOM errors by returning NULL, and added code to make jq exit cleanly if it returns NULL. The code base is filled with these kinds of problems, but this one was easy to fix, so might as well fix it now... Ref: jqlang#2934 (comment) Reported-By: Klemens Nanni <kn@openbsd.org>
1 parent 2a042d6 commit ba1e884

File tree

2 files changed

+14
-6
lines changed

2 files changed

+14
-6
lines changed
 

‎src/main.c

+8-2
Original file line numberDiff line numberDiff line change
@@ -310,6 +310,7 @@ int umain(int argc, char* argv[]) {
310310
int main(int argc, char* argv[]) {
311311
#endif
312312
jq_state *jq = NULL;
313+
jq_util_input_state *input_state = NULL;
313314
int ret = JQ_OK_NO_OUTPUT;
314315
int compiled = 0;
315316
int parser_flags = 0;
@@ -336,15 +337,20 @@ int main(int argc, char* argv[]) {
336337

337338
jq = jq_init();
338339
if (jq == NULL) {
339-
perror("malloc");
340+
perror("jq_init");
340341
ret = JQ_ERROR_SYSTEM;
341342
goto out;
342343
}
343344

344345
int dumpopts = JV_PRINT_INDENT_FLAGS(2);
345346
const char* program = 0;
346347

347-
jq_util_input_state *input_state = jq_util_input_init(NULL, NULL); // XXX add err_cb
348+
input_state = input_jq_util_input_init(NULL, NULL); // XXX add err_cb
349+
if (input_state == NULL) {
350+
perror("input_jq_util_input_init");
351+
ret = JQ_ERROR_SYSTEM;
352+
goto out;
353+
}
348354

349355
int further_args_are_strings = 0;
350356
int further_args_are_json = 0;

‎src/util.c

+6-4
Original file line numberDiff line numberDiff line change
@@ -226,10 +226,12 @@ jq_util_input_state *jq_util_input_init(jq_util_msg_cb err_cb, void *err_cb_data
226226
err_cb_data = stderr;
227227
}
228228
jq_util_input_state *new_state = jv_mem_calloc(1, sizeof(*new_state));
229-
new_state->err_cb = err_cb;
230-
new_state->err_cb_data = err_cb_data;
231-
new_state->slurped = jv_invalid();
232-
new_state->current_filename = jv_invalid();
229+
if(new_state) {
230+
new_state->err_cb = err_cb;
231+
new_state->err_cb_data = err_cb_data;
232+
new_state->slurped = jv_invalid();
233+
new_state->current_filename = jv_invalid();
234+
}
233235

234236
return new_state;
235237
}

0 commit comments

Comments
 (0)
Please sign in to comment.