Fix tonumber and toboolean to reject strings with embedded null bytes - #3496
Merged
Conversation
wader
reviewed
Mar 4, 2026
| jv_free(input); | ||
| return jv_true(); | ||
| } else if (strcmp(s, "false") == 0) { | ||
| } else if (len == 5 && memcmp(s, "false", 5) == 0) { |
Member
There was a problem hiding this comment.
do same len check as in f_tonumber as keep strcmp?
wader
approved these changes
Mar 4, 2026
itchyny
force-pushed
the
fix-tonumber-toboolean-null
branch
from
March 4, 2026 12:51
2dfc3ce to
cc1f31b
Compare
tmeijn
pushed a commit
to tmeijn/dotfiles
that referenced
this pull request
Jul 9, 2026
This MR contains the following updates: | Package | Update | Change | |---|---|---| | [jqlang/jq](https://github.com/jqlang/jq) | patch | `1.8.1` → `1.8.2` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>jqlang/jq (jqlang/jq)</summary> ### [`v1.8.2`](https://github.com/jqlang/jq/releases/tag/jq-1.8.2): jq 1.8.2 [Compare Source](jqlang/jq@jq-1.8.1...jq-1.8.2) This is a patch release with security fixes and bug fixes since 1.8.1, along with new builds for Windows arm64 and Docker arm/v7. Full commit log can be found at <jqlang/jq@jq-1.8.1...jq-1.8.2>. #### Security fixes - CVE-2026-32316: Fix heap buffer overflow in `jvp_string_append` and `jvp_string_copy_replace_bad`. [@​itchyny](https://github.com/itchyny) [`e47e56d`](jqlang/jq@e47e56d) - CVE-2026-33947: Limit path depth to prevent stack overflow in `jv_setpath`, `jv_getpath`, `jv_delpaths`. [@​itchyny](https://github.com/itchyny) [`fb59f14`](jqlang/jq@fb59f14) - CVE-2026-33948: Fix NUL truncation in the JSON parser. [@​itchyny](https://github.com/itchyny) [`6374ae0`](jqlang/jq@6374ae0) - CVE-2026-39956: Fix `_strindices` missing runtime type checks. [@​tlsbollei](https://github.com/tlsbollei) [`fdf8ef0`](jqlang/jq@fdf8ef0) - CVE-2026-39979: Fix out-of-bounds read in `jv_parse_sized()`. [@​wader](https://github.com/wader) [`2f09060`](jqlang/jq@2f09060) - CVE-2026-40164: Randomize hash seed to mitigate hash collision DoS attacks. [@​AsafMeizner](https://github.com/AsafMeizner) [@​itchyny](https://github.com/itchyny) [`0c7d133`](jqlang/jq@0c7d133) - CVE-2026-40612: Limit containment check depth to prevent stack overflow in `contains`. [@​itchyny](https://github.com/itchyny) [`d1a1256`](jqlang/jq@d1a1256) - CVE-2026-41256: Fix NUL truncation in program files loaded with `-f`. [@​itchyny](https://github.com/itchyny) [`5a015de`](jqlang/jq@5a015de) - CVE-2026-41257: Fix signed-int overflow in `stack_reallocate`. [@​itchyny](https://github.com/itchyny) [`01b3cde`](jqlang/jq@01b3cde) - CVE-2026-43894: Reject numeric literals longer than `DEC_MAX_DIGITS` ([`9999999`](jqlang/jq@999999999)). [@​itchyny](https://github.com/itchyny) [`9761ceb`](jqlang/jq@9761ceb) - CVE-2026-43895: Reject embedded NUL bytes in module import paths. [@​itchyny](https://github.com/itchyny) [`9d223f1`](jqlang/jq@9d223f1) - CVE-2026-43896: Limit recursive object merge depth to prevent stack overflow. [@​itchyny](https://github.com/itchyny) [`532ccea`](jqlang/jq@532ccea) - CVE-2026-44777: Detect circular module imports to prevent stack overflow. [@​itchyny](https://github.com/itchyny) [`f58787c`](jqlang/jq@f58787c) - CVE-2026-47770: Guard deep structural equality and comparison recursion. [@​fuyu0425](https://github.com/fuyu0425) [`7122866`](jqlang/jq@7122866) - CVE-2026-49839: Fix heap-buffer-overflow in raw file loading. [@​itchyny](https://github.com/itchyny) [`e987df0`](jqlang/jq@e987df0) - CVE-2026-54679: Tighten string length bounds and propagate invalid jv in implode. [@​itchyny](https://github.com/itchyny) [`46d1da3`](jqlang/jq@46d1da3) - GHSA-gf4g-95wj-4q4r: Fix use-after-free in `args2obj()` array argument path. [@​sseal](https://github.com/sseal) [#​3498](jqlang/jq#3498) - GHSA-hj52-j2c9-r8r4: Fix signed-int overflow in `tokenadd` to prevent buffer overflow. [@​itchyny](https://github.com/itchyny) [`63751f8`](jqlang/jq@63751f8) - Limit the number of function parameters and definitions to prevent SEGV. [@​OwenSanzas](https://github.com/OwenSanzas) [#​3460](jqlang/jq#3460) - Pre-allocate `tokenbuf` for string parser to avoid undefined behavior. [@​fab1ano](https://github.com/fab1ano) [#​3485](jqlang/jq#3485) - Avoid stack overflow when freeing deeply nested values. [@​itchyny](https://github.com/itchyny) [`33d7bce`](jqlang/jq@33d7bce) - Fix memory leaks and double frees. [@​itchyny](https://github.com/itchyny) [#​3487](jqlang/jq#3487) #### Releasing - Add builds for Windows arm64. [@​dennisameling](https://github.com/dennisameling) [#​3376](jqlang/jq#3376) - Support arm/v7 architecture in Docker images. [@​itchyny](https://github.com/itchyny) [#​3463](jqlang/jq#3463) - Update GPG signing key. [@​itchyny](https://github.com/itchyny) [`0ff997f`](jqlang/jq@0ff997f) - Add `artifact-metadata` permission for actions/attest. [@​itchyny](https://github.com/itchyny) [#​3530](jqlang/jq#3530) - Upload attestation bundle as a release artifact, allowing unauthenticated verification via `gh attestation verify --bundle jq-attestation.json`. [@​itchyny](https://github.com/itchyny) [#​3563](jqlang/jq#3563) #### CLI changes - Improve error message truncation with closing delimiters. [@​itchyny](https://github.com/itchyny) [#​3478](jqlang/jq#3478) - Remove extra space from `die` function output. [@​krtk6160](https://github.com/krtk6160) [#​3391](jqlang/jq#3391) - Fix raw input flag not to corrupt multi-byte characters. [@​itchyny](https://github.com/itchyny) [#​3421](jqlang/jq#3421) - Fix crash when importing a module with errors twice. [@​itchyny](https://github.com/itchyny) [#​3497](jqlang/jq#3497) - Increase the maximum printing depth from 256 to 10000. [@​ishnagy](https://github.com/ishnagy) [#​3414](jqlang/jq#3414) #### Changes to existing functions - Fix `rtrimstr("")` always outputting `""`. [@​A4-Tacks](https://github.com/A4-Tacks) [#​3415](jqlang/jq#3415) - Fix infinite loop and undefined behavior in `del(.[nan])`. [@​itchyny](https://github.com/itchyny) [#​3490](jqlang/jq#3490) - Refactor `@uri` and `@urid` to fix multi-byte UTF-8 corruption. [@​itchyny](https://github.com/itchyny) [#​3495](jqlang/jq#3495) - Fix `tonumber` and `toboolean` to reject strings with embedded null bytes. [@​itchyny](https://github.com/itchyny) [#​3496](jqlang/jq#3496) - Fix undefined behavior in modulo operator. [@​fab1ano](https://github.com/fab1ano) [#​3486](jqlang/jq#3486) - Fix reversed pointer subtraction in `f_env` bounds check. [@​itchyny](https://github.com/itchyny) [#​3465](jqlang/jq#3465) - Fix missing validity check in `f_strflocaltime` after `f_localtime`. [@​itchyny](https://github.com/itchyny) [#​3491](jqlang/jq#3491) - Fix year 2038 problem on 32-bit platforms. [@​itchyny](https://github.com/itchyny) [#​3407](jqlang/jq#3407) - Use `//` instead of `//=` in `from_entries` definition. [@​itchyny](https://github.com/itchyny) [#​3516](jqlang/jq#3516) #### Build and test changes - Drop `strptime` test using non-portable `%F`. [@​alyssais](https://github.com/alyssais) [#​3365](jqlang/jq#3365) - Limit oniguruma depth to 1024 in `jq_fuzz_execute`. [@​sudhackar](https://github.com/sudhackar) [#​3377](jqlang/jq#3377) - Fix localization test for time formatting functions. [@​itchyny](https://github.com/itchyny) [#​3409](jqlang/jq#3409) - Fix expected value assertion. [@​itchyny](https://github.com/itchyny) [#​3431](jqlang/jq#3431) [#​3408](jqlang/jq#3408) - Fix typo in tests/jq.test. [@​bigmoonbit](https://github.com/bigmoonbit) [#​3441](jqlang/jq#3441) - Refactor `tm2jv` to handle fractional seconds. [@​itchyny](https://github.com/itchyny) [#​3489](jqlang/jq#3489) - Fix `jq_fuzz_parse_stream`: use iterative parser API for streaming mode. [@​OwenSanzas](https://github.com/OwenSanzas) [#​3499](jqlang/jq#3499) - Fix crashes and resource leaks in `jq_testsuite`. [@​itchyny](https://github.com/itchyny) [#​3509](jqlang/jq#3509) - Support building with `--disable-maintainer-mode` and source != build dir. [@​Saur2000](https://github.com/Saur2000) [#​3518](jqlang/jq#3518) - Add Solaris support. [@​vlmarek](https://github.com/vlmarek) [#​3515](jqlang/jq#3515) - Respect `SOURCE_DATE_EPOCH` while generating man page. [@​McSinyx](https://github.com/McSinyx) [#​3514](jqlang/jq#3514) - Fix undefined pointer arithmetic in UTF-8 helpers. [@​theyoucheng](https://github.com/theyoucheng) [`df924ea`](jqlang/jq@df924ea) - Fix one-byte over-read in `BASE64_DECODE_TABLE`. [@​itchyny](https://github.com/itchyny) [#​3547](jqlang/jq#3547) #### Documentation changes - Add wiki link to navigation bar. [@​wader](https://github.com/wader) [#​3424](jqlang/jq#3424) - Add missing word in manual for rawfile. [@​jpmens](https://github.com/jpmens) [#​3434](jqlang/jq#3434) - Fix typo "stder" to "stderr". [@​jjatria](https://github.com/jjatria) [#​3446](jqlang/jq#3446) - Fix buttons in tutorial to toggle labels when clicked on. [@​itchyny](https://github.com/itchyny) [#​3493](jqlang/jq#3493) - Fix "happened" spelling in tutorial changelog entries. [@​Rohan5commit](https://github.com/Rohan5commit) [#​3525](jqlang/jq#3525) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box --- This MR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNTYuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI1Ni4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJSZW5vdmF0ZSBCb3QiLCJhdXRvbWF0aW9uOmJvdC1hdXRob3JlZCIsImRlcGVuZGVuY3ktdHlwZTo6cGF0Y2giXX0=-->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR fixes some filters with embedded null bytes.