Project: jq (jqlang/jq), language: c++
Vulnerability instance: jq.cve-2023-50246
Sanitizer: address

================= Bug Report (1/2) ==================
## Source: GitHub Advisory
## URL: https://github.com/jqlang/jq/security/advisories/GHSA-686w-5m7m-54vc
## Description:
Advisory ID: GHSA-686w-5m7m-54vc
Title: heap-buffer-overflow exists in the function decToString in decNumber.c

Description:
System info
Ubuntu x86_64, clang 12.0
version: jq-master-cca1f7d-dirty
Command line
./jq . poc
Poc
poc:poc
AddressSanitizer output
==542903==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x613000000188 at pc 0x00000054e6e3 bp 0x7ffdf15aa0b0 sp 0x7ffdf15aa0a8
WRITE of size 1 at 0x613000000188 thread T0
#0 0x54e6e2 in decToString /src/jq/src/decNumber/decNumber.c:3764:5
#1 0x54c9d2 in decNumberToString /src/jq/src/decNumber/decNumber.c:449:3
#2 0x4f6b54 in jvp_literal_number_literal /src/jq/src/jv.c:653:5
#3 0x4f6b54 in jv_number_get_literal /src/jq/src/jv.c:668:12
#4 0x53a80b in jv_dump_term /src/jq/src/jv_print.c:231:35
#5 0x53eba6 in jv_dumpf /src/jq/src/jv_print.c:368:3
#6 0x53eba6 in jv_dump /src/jq/src/jv_print.c:372:3
#7 0x4ce841 in process /src/jq/src/main.c:207:7
#8 0x4cd2ac in main /src/jq/src/main.c:724:15
#9 0x7fe078a4f082 in __libc_start_main /build/glibc-BHL3KM/glibc-2.31/csu/../csu/libc-start.c:308:16
#10 0x41d7bd in _start (/src/jq/jq+0x41d7bd)
0x613000000188 is located 0 bytes to the right of 328-byte region [0x613000000040,0x613000000188)
allocated by thread T0 here:
#0 0x49867d in malloc (/src/jq/jq+0x49867d)
#1 0x5084bf in jv_mem_alloc /src/jq/src/jv_alloc.c:141:13
#2 0x53eba6 in jv_dumpf /src/jq/src/jv_print.c:368:3
#3 0x53eba6 in jv_dump /src/jq/src/jv_print.c:372:3
SUMMARY: AddressSanitizer: heap-buffer-overflow /src/jq/src/decNumber/decNumber.c:3764:5 in decToString
Shadow bytes around the buggy address:
0x0c267fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c267fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c267fff8000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c267fff8010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c267fff8020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c267fff8030: 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c267fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c267fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c267fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c267fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c267fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==542903==ABORTING


References:
https://github.com/SEU-SSL/Poc/raw/main/jq/id_000000,sig_06,src_003363+001607,op_splice,rep_32
https://github.com/jqlang/jq/issues/1
https://github.com/jqlang/jq/issues/2
https://github.com/jqlang/jq/issues/3
https://github.com/jqlang/jq/issues/4
https://github.com/jqlang/jq/issues/5
https://github.com/jqlang/jq/pull/6
https://github.com/jqlang/jq/issues/7
https://github.com/jqlang/jq/pull/8
https://github.com/jqlang/jq/issues/9
https://github.com/jqlang/jq/issues/10

================= Bug Report (2/2) ==================
## Source: Chromium
## URL: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64574
## Description:
Detailed Report: https://oss-fuzz.com/testcase?key=4714293282865152

Project: jq
Fuzzing Engine: libFuzzer
Fuzz Target: jq_fuzz_parse_extended
Job Type: libfuzzer_asan_jq
Platform Id: linux

Crash Type: Heap-buffer-overflow WRITE 1
Crash Address: 0x6020000000c0
Crash State:
  decToString
  decNumberToString
  jv_number_get_literal
 
Sanitizer: address (ASAN)

Recommended Security Severity: High

Regressed: https://oss-fuzz.com/revisions?job=libfuzzer_asan_jq&range=202311280623:202311290622

Reproducer Testcase: https://oss-fuzz.com/download?testcase_id=4714293282865152

Issue filed automatically.

See https://google.github.io/oss-fuzz/advanced-topics/reproducing for instructions to reproduce this bug locally.
When you fix this bug, please
  * mention the fix revision(s).
  * state whether the bug was a short-lived regression or an old bug in any stable releases.
  * add any other useful information.
This information can help downstream consumers.

If you need to contact the OSS-Fuzz team with a question, concern, or any other feedback, please file an issue at https://github.com/google/oss-fuzz/issues. Comments on individual Monorail issues are not monitored.

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without an upstream patch, then the bug report will automatically
become visible to the public.

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
autoreconf -fi
./configure --with-oniguruma=builtin
make -j$(nproc)
mkdir -p $SRC/seeds

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make flex bison libtool automake autoconf
RUN git clone https://github.com/jqlang/jq jq
RUN git -C jq checkout c9a51565214eece8f1053089739aea73145bfd6b
WORKDIR $SRC/jq
COPY build.sh $SRC/

Additional files:
filename: jq.dict
content: "acos"
"acosh"
"add"
"all"
"any"
"arrays"
"ascii_downcase"
"ascii_upcase"
"asin"
"asinh"
"atan"
"atan2"
"atanh"
"booleans"
"bsearch"
"builtins"
"capture"
"cbrt"
"ceil"
"combinations"
"contains"
"copysign"
"cos"
"cosh"
"debug"
"del"
"delpaths"
"drem"
"empty"
"endswith"
"env"
"erf"
"erfc"
"error"
"error"
"exp"
"exp10"
"exp2"
"explode"
"expm1"
"fabs"
"fdim"
"finites"
"first"
"first"
"flatten"
"floor"
"fma"
"fmax"
"fmin"
"fmod"
"format"
"frexp"
"fromdate"
"fromdateiso8601"
"from_entries"
"fromjson"
"fromstream"
"gamma"
"get_jq_origin"
"getpath"
"get_prog_origin"
"get_search_list"
"gmtime"
"group_by"
"gsub"
"halt"
"halt_error"
"halt_error"
"has"
"hypot"
"implode"
"in"
"IN"
"index"
"INDEX"
"indices"
"infinite"
"input"
"input_filename"
"input_line_number"
"inputs"
"inside"
"isempty"
"isfinite"
"isinfinite"
"isnan"
"isnormal"
"iterables"
"j0"
"j1"
"jn"
"join"
"JOIN"
"keys"
"keys_unsorted"
"last"
"last"
"ldexp"
"leaf_paths"
"length"
"lgamma"
"lgamma_r"
"limit"
"localtime"
"log"
"log10"
"log1p"
"log2"
"logb"
"ltrimstr"
"map"
"map_values"
"match"
"max"
"max_by"
"min"
"min_by"
"mktime"
"modf"
"modulemeta"
"nan"
"nearbyint"
"nextafter"
"nexttoward"
"normals"
"not"
"now"
"nth"
"nth"
"nulls"
"numbers"
"objects"
"path"
"paths"
"pow"
"pow10"
"range"
"range"
"range"
"recurse"
"recurse_down"
"remainder"
"repeat"
"reverse"
"rindex"
"rint"
"round"
"rtrimstr"
"scalars"
"scalars_or_empty"
"scalb"
"scalbln"
"scan"
"select"
"setpath"
"significand"
"sin"
"sinh"
"sort"
"sort_by"
"split"
"split"
"splits"
"sqrt"
"startswith"
"stderr"
"strflocaltime"
"strftime"
"strings"
"strptime"
"sub"
"tan"
"tanh"
"test"
"tgamma"
"todate"
"todateiso8601"
"to_entries"
"tojson"
"tonumber"
"tostream"
"tostring"
"transpose"
"trunc"
"truncate_stream"
"type"
"unique"
"unique_by"
"until"
"utf8bytelength"
"values"
"walk"
"while"
"with_entries"
"y0"
"y1"
"yn"