@ 261102.1

260424.2 · 01b3cded76daacbfddb7f8763700b0803bcb5c6f

Fix signed-int overflow in `stack_reallocate`

This fixes CVE-2026-41257.

reading declarations

Changes to src/exec_stack.h. All files

src/exec_stack.h

@@ -2,8 +2,10 @@ #define EXEC_STACK_H #include <stddef.h> #include <stdint.h>+#include <stdio.h> #include <stdlib.h> #include <string.h>+#include <limits.h> #include "jv_alloc.h"  /*@@ -81,15 +83,19 @@ static stack_ptr* stack_block_next(struct stack* s, stack_ptr p) { }  static void stack_reallocate(struct stack* s, size_t sz) {-  int old_mem_length = -(s->bound) + ALIGNMENT;-  char* old_mem_start = (s->mem_end != NULL) ? (s->mem_end - old_mem_length) : NULL;+  size_t old_mem_length = (size_t)(-(s->bound)) + ALIGNMENT;+  char* old_mem_start = s->mem_end != NULL ? s->mem_end - old_mem_length : NULL; -  int new_mem_length = align_round_up((old_mem_length + sz + 256) * 2);+  size_t new_mem_length = align_round_up((old_mem_length + sz + 256) * 2);+  if (new_mem_length > INT_MAX) {+    fprintf(stderr, "jq: error: cannot allocate memory\n");+    abort();+  }   char* new_mem_start = jv_mem_realloc(old_mem_start, new_mem_length);   memmove(new_mem_start + (new_mem_length - old_mem_length),             new_mem_start, old_mem_length);   s->mem_end = new_mem_start + new_mem_length;-  s->bound = -(new_mem_length - ALIGNMENT);+  s->bound = -(int)(new_mem_length - ALIGNMENT); }  static stack_ptr stack_push_block(struct stack* s, stack_ptr p, size_t sz) {