| commit | 7be6870751c2ab3f49365a955c51ce5ba1f1b752 | [log] [tgz] |
|---|---|---|
| author | Samar Sunkaria <sameesunkaria@me.com> | Wed Jun 05 06:19:08 2024 +0200 |
| committer | GitHub <noreply@github.com> | Wed Jun 05 13:19:08 2024 +0900 |
| tree | 9e5ff9d3b48d4dd2be562e42ea21c450cfd1d991 | |
| parent | 5208a4425f24f5c366dfed2eae85f1935199d683 [diff] |
Remove multiple calls to free when successively calling jq_reset. (#3134) `jq_reset` calls `jv_free` on the `exit_code` and the `error_message` stored on the jq state. However, it doesn't replace the actual instance of those members. This means that subsequent calls to `jq_reset` will call `jv_free` again on those members, which in turn may call `free` on the same pointer multiple times. Freeing the same pointer multiple times is undefined behavior and can cause heap corruption, which is how I spotted this issue. In practice, this issue only occurs when using a program that may `halt_error`, because that is when the `exit_code` and `error_message` are set to values other than `jv_invalid`. Subsequent attempts to call `jq_start` (which calls `jq_reset` internally) after hitting a `halt_error` can cause you to run into this issue. The changes simply reset the `exit_code` and the `error_message` to `jv_invalid` (the initial value set in `jq_init`) after they are freed.
jq is a lightweight and flexible command-line JSON processor akin to sed,awk,grep, and friends for JSON data. It's written in portable C and has zero runtime dependencies, allowing you to easily slice, filter, map, and transform structured data.
Download the latest releases from the GitHub release page.
Pull the jq image to start quickly with Docker.
package.json filedocker run --rm -i ghcr.io/jqlang/jq:latest < package.json '.version'
package.json file with a mounted volumedocker run --rm -i -v "$PWD:$PWD" -w "$PWD" ghcr.io/jqlang/jq:latest '.version' package.json
git submodule update --init # if building from git to get oniguruma autoreconf -i # if building from git ./configure --with-oniguruma=builtin make clean # if upgrading from a version previously built from source make -j8 make check sudo make install
Build a statically linked version:
make LDFLAGS=-all-static
If you‘re not using the latest git version but instead building a released tarball (available on the release page), skip the autoreconf step, and flex or bison won’t be needed.
For details on cross-compilation, check out the GitHub Actions file and the cross-compilation wiki page.
jq is released under the MIT License. jq's documentation is licensed under the Creative Commons CC BY 3.0. jq uses parts of the open source C library “decNumber”, which is distributed under ICU License