Skip to content

Commit

Permalink
Fix possible uninitialised value dereference if jq_init() fails
Browse files Browse the repository at this point in the history
If jq_init() fails, goto out would try to free input_state which is
uninitialised. I initialised input_state to NULL to fix the problem.

I also fixed jq_util_input_init() not handling OOM errors by returning
NULL, and added code to make jq exit cleanly if it returns NULL. The
code base is filled with these kinds of problems, but this one was easy
to fix, so might as well fix it now...

Ref: jqlang#2934 (comment)

Reported-By: Klemens Nanni <kn@openbsd.org>
  • Loading branch information
emanuele6 committed Oct 22, 2023
1 parent 9de0e26 commit ab3b649
Show file tree
Hide file tree
Showing 2 changed files with 14 additions and 6 deletions.
10 changes: 8 additions & 2 deletions src/main.c
Original file line number Diff line number Diff line change
Expand Up @@ -310,6 +310,7 @@ int umain(int argc, char* argv[]) {
int main(int argc, char* argv[]) {
#endif
jq_state *jq = NULL;
jq_util_input_state *input_state = NULL;
int ret = JQ_OK_NO_OUTPUT;
int compiled = 0;
int parser_flags = 0;
Expand All @@ -336,15 +337,20 @@ int main(int argc, char* argv[]) {

jq = jq_init();
if (jq == NULL) {
perror("malloc");
perror("jq_init");
ret = JQ_ERROR_SYSTEM;
goto out;
}

int dumpopts = JV_PRINT_INDENT_FLAGS(2);
const char* program = 0;

jq_util_input_state *input_state = jq_util_input_init(NULL, NULL); // XXX add err_cb
input_state = jq_util_input_init(NULL, NULL); // XXX add err_cb
if (input_state == NULL) {
perror("jq_util_input_init");
ret = JQ_ERROR_SYSTEM;
goto out;
}

int further_args_are_strings = 0;
int further_args_are_json = 0;
Expand Down
10 changes: 6 additions & 4 deletions src/util.c
Original file line number Diff line number Diff line change
Expand Up @@ -226,10 +226,12 @@ jq_util_input_state *jq_util_input_init(jq_util_msg_cb err_cb, void *err_cb_data
err_cb_data = stderr;
}
jq_util_input_state *new_state = jv_mem_calloc(1, sizeof(*new_state));
new_state->err_cb = err_cb;
new_state->err_cb_data = err_cb_data;
new_state->slurped = jv_invalid();
new_state->current_filename = jv_invalid();
if (new_state) {
new_state->err_cb = err_cb;
new_state->err_cb_data = err_cb_data;
new_state->slurped = jv_invalid();
new_state->current_filename = jv_invalid();
}

return new_state;
}
Expand Down

0 comments on commit ab3b649

Please sign in to comment.