Commit Graph
9 Commits
Author SHA1 Message Date
itchyny e001deb4cf Strip UTF-8 BOM at the start of each input file (#3657)
The UTF-8 BOM was stripped only at the start of the parser stream, but jq
feeds all input files into a single parser, so a BOM at the start of the
second and later files reached the parser as content and failed with a
confusing "Invalid numeric literal" error. Strip it in the file readers
instead, at the start of each input file including stdin, and in
jv_load_file.

This also strips the BOM for raw input, so -R and --rawfile no longer
yield a leading U+FEFF, and a BOM at the start of a -f program file or an
imported module is now accepted rather than reported as a syntax error.
In exchange, "\uFEFF1" | fromjson is now a parse error, since a U+FEFF
inside a string is content rather than an encoding marker, and the
dedicated "Malformed BOM" error is gone.
2026-10-08 23:01:36 +09:00
itchyny e987df0d46 Fix heap-buffer-overflow in raw file loading
When `jv_string_append_buf` overflows the string length limit,
it returns an invalid `jv`; `jv_load_file` then re-entered it
on the invalid value and overran the heap. Break out of the loop
once the value is invalid.

Fixes CVE-2026-49839.
2026-06-08 22:15:06 +09:00
itchyny 750dbe723b Fix memory leaks and double frees (#3487) 2026-03-01 06:15:58 +09:00
itchyny 5529788292 Fix slurping raw input not to corrupt multi-byte characters (fix #3389) (#3421) 2025-10-31 15:16:29 +09:00
Roland C. Dowdeswell 90bc29c1b5 jv_file.c: check to see if the file is a directory and fail
Not all stdio implementations disallow one to open a directory with
fopen(3) and so we specifically check for directories as it is also
in the standard search path.
2018-05-11 19:32:25 -05:00
Nicolas Williams 10d66051ef Fix jv_load_file() assertion (fix #1410) 2017-05-20 18:53:48 -05:00
Yasuhiro Matsumoto 12c60b2f32 Quiet a compiler warning 2017-02-25 18:49:22 -06:00
William Langford e84d17196c Handle cut-off UTF-8 sequences when reading files
Read additional bytes from the file to complete the UTF-8 sequence so the bytes
in it don't get converted to U+FFFD replacement characters.
2017-01-27 21:04:26 -05:00
David Tolnay 0c93eb3379 Move source files to src/ 2015-08-23 20:36:11 -07:00