From 2f09060afab23fe9390cce7cb860b10416e1bf5f Mon Sep 17 00:00:00 2001 From: itchyny Date: Mon, 13 Apr 2026 11:04:52 +0900 Subject: [PATCH] Fix out-of-bounds read in jv_parse_sized() This fixes CVE-2026-39979. Co-authored-by: Mattias Wadman Upstream: https://github.com/jqlang/jq/commit/2f09060afab23fe9390cce7cb860b10416e1bf5f CVE: CVE-2026-39979 Signed-off-by: Thomas Perale --- src/jv_parse.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/jv_parse.c b/src/jv_parse.c index aa2054cc09..56847b5eaa 100644 --- a/src/jv_parse.c +++ b/src/jv_parse.c @@ -892,8 +892,9 @@ jv jv_parse_sized_custom_flags(const char* string, int length, int flags) { if (!jv_is_valid(value) && jv_invalid_has_msg(jv_copy(value))) { jv msg = jv_invalid_get_msg(value); - value = jv_invalid_with_msg(jv_string_fmt("%s (while parsing '%s')", + value = jv_invalid_with_msg(jv_string_fmt("%s (while parsing '%.*s')", jv_string_value(msg), + length, string)); jv_free(msg); }