From 9e23fd7e88bb2d76ddf3fbfc805199f848cd1b92 Mon Sep 17 00:00:00 2001
From: itchyny <itchyny@cybozu.co.jp>
Date: Sat, 31 May 2025 11:46:40 +0900
Subject: [PATCH 2/2] Fix heap buffer overflow when formatting an empty string

The `jv_string_empty` did not properly null-terminate the string data,
which could lead to a heap buffer overflow. The test case of
GHSA-p7rr-28xf-3m5w (`0[""*0]`) was fixed by the commit dc849e9bb74a,
but another case (`0[[]|implode]`) was still vulnerable. This commit
ensures string data is properly null-terminated, and fixes CVE-2025-48060.

CVE: CVE-2025-48060
Upstream-Status: Backport [https://github.com/jqlang/jq/commit/c6e041699d8cd31b97375a2596217aff2cfca85b]
Signed-off-by: Colin Pinnell McAllister <colin.mcallister@garmin.com>
---
 src/jv.c      | 1 +
 tests/jq.test | 4 ++++
 2 files changed, 5 insertions(+)

diff --git a/src/jv.c b/src/jv.c
index 33ccee9..4d7bba1 100644
--- a/src/jv.c
+++ b/src/jv.c
@@ -1131,6 +1131,7 @@ static jv jvp_string_empty_new(uint32_t length) {
   jvp_string* s = jvp_string_alloc(length);
   s->length_hashed = 0;
   memset(s->data, 0, length);
+  s->data[length] = 0;
   jv r = {JVP_FLAGS_STRING, 0, 0, 0, {&s->refcnt}};
   return r;
 }
diff --git a/tests/jq.test b/tests/jq.test
index c6c6ee5..f783493 100644
--- a/tests/jq.test
+++ b/tests/jq.test
@@ -1720,3 +1720,7 @@ false
 . |= try . catch .
 1
 1
+
+try 0[implode] catch .
+[]
+"Cannot index number with string \"\""
-- 
2.49.0

