From aea65caf03c129f3303d044044d2d1105be81b71 Mon Sep 17 00:00:00 2001
From: itchyny <itchyny@cybozu.co.jp>
Date: Wed, 5 Mar 2025 07:43:54 +0900
Subject: [PATCH 2/2] Reject NaN with payload while parsing JSON

This commit drops support for parsing NaN with payload in JSON like
`NaN123` and fixes CVE-2024-53427. Other JSON extensions like `NaN` and
`Infinity` are still supported. Fixes #3023, fixes #3196, fixes #3246.

CVE: CVE-2024-53427
Upstream-Status: Backport [https://github.com/jqlang/jq/commit/a09a4dfd55e6c24d04b35062ccfe4509748b1dd3]
Signed-off-by: Colin Pinnell McAllister <colin.mcallister@garmin.com>
---
 src/jv.c      |  5 +++++
 tests/jq.test | 12 ++++++++++++
 2 files changed, 17 insertions(+)

diff --git a/src/jv.c b/src/jv.c
index 9051f65..4da5ba8 100644
--- a/src/jv.c
+++ b/src/jv.c
@@ -617,6 +617,11 @@ static jv jvp_literal_number_new(const char * literal) {
     return JV_INVALID;
   }
   if (decNumberIsNaN(&n->num_decimal)) {
+    // Reject NaN with payload.
+    if (n->num_decimal.digits > 1 || *n->num_decimal.lsu != 0) {
+      jv_mem_free(n);
+      return JV_INVALID;
+    }
     jv_mem_free(n);
     return jv_number(NAN);
   }
diff --git a/tests/jq.test b/tests/jq.test
index f783493..0ab21ef 100644
--- a/tests/jq.test
+++ b/tests/jq.test
@@ -1724,3 +1724,15 @@ false
 try 0[implode] catch .
 []
 "Cannot index number with string \"\""
+
+# NaN with payload is not parsed
+.[] | try (fromjson | isnan) catch .
+["NaN","-NaN","NaN1","NaN10","NaN100","NaN1000","NaN10000","NaN100000"]
+true
+true
+"Invalid numeric literal at EOF at line 1, column 4 (while parsing 'NaN1')"
+"Invalid numeric literal at EOF at line 1, column 5 (while parsing 'NaN10')"
+"Invalid numeric literal at EOF at line 1, column 6 (while parsing 'NaN100')"
+"Invalid numeric literal at EOF at line 1, column 7 (while parsing 'NaN1000')"
+"Invalid numeric literal at EOF at line 1, column 8 (while parsing 'NaN10000')"
+"Invalid numeric literal at EOF at line 1, column 9 (while parsing 'NaN100000')"
-- 
2.49.0

