Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-37827

JQ findings from static application security testing

    • Icon: Bug Bug
    • Resolution: Done-Errata
    • Icon: Undefined Undefined
    • rhel-8.10.z
    • rhel-8.0.0, CentOS Stream 8, CentOS Stream 9, rhel-9.0.0
    • jq
    • None
    • jq-1.6-9.el8_10
    • None
    • Moderate
    • rhel-sst-idm-sssd
    • ssg_idm
    • 0
    • QE ack, Dev ack
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • All
    • None

      Few non-critical findings has been found in JQ code.

      1.

      Error: VARARGS (CWE-237):
      jq-1.6/src/locfile.c:65: va_init: Initializing va_list "fmtargs".
      jq-1.6/src/locfile.c:77: missing_va_end: "va_end" was not called for "fmtargs".
      #   75|     if (!jv_is_valid(m1)) {
      #   76|       jq_report_error(l->jq, m1);
      #   77|->     return;
      #   78|     }
      #   79|     if (loc.start == -1) {Error: VARARGS (CWE-237):
      

       

      2.

      Error: VARARGS (CWE-237):
      jq-1.6/src/locfile.c:65: va_init: Initializing va_list "fmtargs".
      jq-1.6/src/locfile.c:90: missing_va_end: "va_end" was not called for "fmtargs".
      #   88|     jv_free(m1);
      #   89|     jq_report_error(l->jq, m2);
      #   90|->   return;
      #   91|   } 

       

      3.

      Error: RESOURCE_LEAK (CWE-772):
      jq-1.6/src/jq_test.c:31: alloc_fn: Storage is returned from allocation function "fopen".
      jq-1.6/src/jq_test.c:31: var_assign: Assigning: "testdata" = storage returned from "fopen(argv[i], "r")".
      jq-1.6/src/jq_test.c:39: noescape: Resource "testdata" is not freed or pointed-to in "run_jq_tests".
      jq-1.6/src/jq_test.c:43: leaked_storage: Variable "testdata" going out of scope leaks the storage it points to.
      #   41|     run_jq_pthread_tests();
      #   42|   #endif
      #   43|->   return 0;
      #   44|   }
      #   45|   // code placeholder
      

       

      4.

      Error: VARARGS (CWE-237):
      jq-1.6/src/locfile.c:65: va_init: Initializing va_list "fmtargs".
      jq-1.6/src/locfile.c:82: missing_va_end: "va_end" was not called for "fmtargs".
      #   80|       jq_report_error(l->jq, jv_string_fmt("jq: error: %s\n<unknown location>", jv_string_value(m1)));
      #   81|       jv_free(m1);
      #   82|->     return;
      #   83|     }
      #   84|     jv m2 = jv_string_fmt("%s at %s, line %d:\n%.*s%*s", jv_string_value(m1), 

       

      5.

      Error: RESOURCE_LEAK (CWE-772):
      jq-1.6/src/jq_test.c:31: alloc_fn: Storage is returned from allocation function "fopen".
      jq-1.6/src/jq_test.c:31: var_assign: Assigning: "testdata" = storage returned from "fopen(argv[i], "r")".
      jq-1.6/src/jq_test.c:31: overwrite_var: Overwriting "testdata" in "testdata = fopen(argv[i], "r")" leaks the storage that "testdata" points to.
      #   29|           i++;
      #   30|         } else {
      #   31|->         testdata = fopen(argv[i], "r");
      #   32|           if (!testdata) {
      #   33|             perror("fopen"); 

       

              thalman@redhat.com Tomas Halman
              thalman@redhat.com Tomas Halman
              Tomas Halman Tomas Halman
              Scott Poore Scott Poore
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated:
                Resolved: