.fmf/version

@@ -0,0 +1 @@
+1

.gitignore

@@ -1 +1,2 @@
 SOURCES/jq-1.6.tar.gz
+/jq-1.6.tar.gz

.jq.metadata

@@ -1 +0,0 @@
-02959bca30672e0dfe678e7b36464c8fb08ec389 SOURCES/jq-1.6.tar.gz

0005-sast.patch

@@ -0,0 +1,52 @@
+diff -up jq-1.6/src/jq_test.c.orig jq-1.6/src/jq_test.c
+--- jq-1.6/src/jq_test.c.orig	2024-05-03 11:47:47.403617188 +0200
++++ jq-1.6/src/jq_test.c	2024-05-03 11:48:46.569675199 +0200
+@@ -16,6 +16,7 @@ static void run_jq_pthread_tests();
+ 
+ int jq_testsuite(jv libdirs, int verbose, int argc, char* argv[]) {
+   FILE *testdata = stdin;
++  const char *testdata_filename = NULL;
+   int skip = -1;
+   int take = -1;
+   jv_test();
+@@ -28,18 +29,24 @@ int jq_testsuite(jv libdirs, int verbose
+         take = atoi(argv[i+1]);
+         i++;
+       } else {
+-        testdata = fopen(argv[i], "r");
+-        if (!testdata) {
+-          perror("fopen");
+-          exit(1);
+-        }
++        testdata_filename = argv[i];
+       }
+     }
+   }
++  if (testdata_filename) {
++    testdata = fopen(testdata_filename, "r");
++    if (!testdata) {
++      perror("fopen");
++      exit(1);
++    }
++  }
+   run_jq_tests(libdirs, verbose, testdata, skip, take);
+ #ifdef HAVE_PTHREAD
+   run_jq_pthread_tests();
+ #endif
++  if (testdata_filename) {
++    fclose(testdata);
++  }
+   return 0;
+ }
+ 
+diff -up jq-1.6/src/locfile.c.orig jq-1.6/src/locfile.c
+--- jq-1.6/src/locfile.c.orig	2018-11-02 02:49:29.000000000 +0100
++++ jq-1.6/src/locfile.c	2024-05-03 11:15:46.562476303 +0200
+@@ -72,6 +72,7 @@ void locfile_locate(struct locfile* l, l
+   }
+ 
+   jv m1 = jv_string_vfmt(fmt, fmtargs);
++  va_end(fmtargs);
+   if (!jv_is_valid(m1)) {
+     jq_report_error(l->jq, m1);
+     return;

gating.yaml

@@ -0,0 +1,6 @@
+--- !Policy
+product_versions:
+  - rhel-8
+decision_context: osci_compose_gate
+rules:
+  - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}

jq.spec

@@ -1,6 +1,6 @@
 Name:           jq
 Version:        1.6
-Release:        8%{?dist}
+Release:        9%{?dist}
 Summary:        Command-line JSON processor
 
 License:        MIT and ASL 2.0 and CC-BY and GPLv3
@@ -11,6 +11,7 @@ Patch1:         0001-iterration-problem-for-non-decimal-string.patch
 Patch2:         0002-add-mantest.patch
 Patch3:         0003-fix-pthread-segfault.patch
 Patch4:         0004-make-jq-fast.patch
+Patch5:         0005-sast.patch
 
 BuildRequires:  flex
 BuildRequires:  bison
@@ -99,6 +100,10 @@ make check
 
 
 %changelog
+* Fri May 3 2024  Tomas Halman <thalman@redhat.com> - 1.6-9
+- Fix SAST findings in jq 1.6
+- Resolves: RHEL-37827
+
 * Fri Oct 13 2023 Tomas Halman <thalman@redhat.com> - 1.6-8
 - Make jq 1.6 fast
 - Resolves: RHEL-5052

plans/all.fmf

@@ -0,0 +1,23 @@
+summary: Run gating tests
+discover:
+    how: fmf
+    dist-git-source: true
+    dist-git-type: centos
+prepare:
+  - how: install
+    package:
+      - dnf-plugins-core
+      - https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
+  - how: shell
+    script: /usr/bin/crb enable
+  - how: install
+    package:
+      - jq
+      - jq-devel
+      - gcc
+      - wget
+  - how: shell
+    script: dnf config-manager --disable epel*
+
+execute:
+    how: tmt

sources

@@ -0,0 +1 @@
+SHA512 (jq-1.6.tar.gz) = f5ae8be558ca2ff15324c378d623106b74bd0823be50835e23548584aa1eb24eb81f8f054693d5d3fe44f157d0735c5f0f40b9f21899ba068f2a11d1345ace19

tests/performance/jqspeed.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+
+export LC_ALL=C
+
+stress_jq() {
+    `which time` -p -f '%e\n' bash -c 'for i in `seq 1 1000` ; do echo '"'"'{"foo":"bar"}'"'"' | jq '"'"'has("bar")'"'"' > /dev/null ; done' 2>&1 | cut -d. -f1
+}
+
+FAIL=0
+TIME=`stress_jq`
+echo -n "Test jqspeed ... "
+if [ $TIME -gt 8 ] ; then
+    echo "failed"
+    FAIL=1
+else
+    echo "ok"
+fi
+
+echo "Runtime: ${TIME}s "
+exit $FAIL

tests/performance/main.fmf

@@ -0,0 +1,6 @@
+summary: Run jq performance/speed test
+require:
+  - jq
+  - which
+  - time
+test: ./jqspeed.sh

tests/provision.fmf

@@ -0,0 +1,5 @@
+---
+
+standard-inventory-qcow2:
+  qemu:
+    m: 2G

tests/segfault/jqsegfault.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+
+FAIL=0
+
+# Test for segfault in multithreaded environment
+gcc -o test_segfault test_segfault_with_multithreaded_env.c -lpthread -ljq && \
+./test_segfault
+RET=$?
+
+echo -n "Test jqsegfault ... "
+
+if [ $RET != 0 ]; then
+    echo "failed"
+    FAIL=1
+else
+    echo "ok"
+fi
+
+exit $FAIL

tests/segfault/main.fmf

@@ -0,0 +1,8 @@
+summary: Run segfault threads test
+require:
+  - wget
+  - dnf-utils
+  - gcc
+  - jq
+  - jq-devel
+test: ./jqsegfault.sh

tests/segfault/test_segfault_with_multithreaded_env.c

@@ -0,0 +1,90 @@
+#include <stdlib.h>
+#include <jq.h>
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+#include <pthread.h>
+
+int my_jq_parse(jq_state *jq, struct jv_parser *parser)
+{
+    int rv = 0;
+    jv value;
+
+    value = jv_parser_next(parser);
+    while (jv_is_valid(value)) {
+        jq_start(jq, value, 0);
+        jv result;
+
+        while (jv_is_valid(result = jq_next(jq))) {
+            jv dumped = jv_dump_string(result, 0);
+            const char *str = jv_string_value(dumped);
+            printf("dumped: %s\n", str);
+        }
+
+        jv_free(result);
+        value = jv_parser_next(parser);
+    }
+
+    if (jv_invalid_has_msg(jv_copy(value))) {
+        jv msg = jv_invalid_get_msg(value);
+        printf("invalid: %s\n", jv_string_value(msg));
+        jv_free(msg);
+        rv = 1;
+    } else {
+        jv_free(value);
+    }
+
+    return rv;
+}
+
+void *run(void *not_used) {
+    int rv;
+    jq_state *jq;
+    const char *prg = ".data";
+
+    jq = jq_init();
+    printf("jq_init jq: %p prg: %s\n", jq, prg);
+    if (jq_compile(jq, prg) == 0) {
+        jq_teardown(&jq);
+        return NULL;
+    }
+    printf("compiled\n");
+
+    struct jv_parser *parser = jv_parser_new(0);
+    const char *buf = "{ \"data\": 1 }";
+    jv_parser_set_buf(parser, buf, strlen(buf), 0);
+    rv = my_jq_parse(jq, parser);
+    if (rv != 0) {
+        printf("my_jq_parse failed!\n");
+    }
+
+    jv_parser_free(parser);
+    jq_teardown(&jq);
+    return NULL;
+}
+
+#define THREADS 2
+/* calling run() twice works fine */
+/* calling them in threads causes core-dump */
+int main (int argc, char *argv[])
+{
+    pthread_t threads[THREADS];
+    int createerror;
+    int a;
+
+     memset(&threads, 0, sizeof(threads));
+    for (a = 0; a < THREADS; ++a) {
+        // sleep(1); // < if you want to run threads sequentionally 
+        createerror = pthread_create(&threads[a], NULL, run, NULL);
+        if (createerror) {
+            printf("create thread error %d\n", a);
+        }
+    }
+    for(a = 0; a < THREADS; ++a) {
+        if (threads[a] != 0) {
+            pthread_join(threads[a], NULL);
+        }
+    }
+
+    return 0;
+}

tests/tests.yml

@@ -0,0 +1,27 @@
+---
+- hosts: localhost
+  roles:
+  - role: standard-test-source
+    tags:
+    - always
+
+  - role: standard-test-basic
+    tags:
+    - classic
+    required_packages:
+    - jq
+    - gcc
+    - wget
+    - jq-devel
+    - valgrind
+    - rubygem-rake
+    tests:
+    - upstream:
+        dir: upstream
+        run: ./jqtests.sh
+    - segfault:
+        dir: segfault
+        run: ./jqsegfault.sh
+    - performance:
+        dir: performance
+        run: ./jqspeed.sh

tests/upstream/jqtests.sh

@@ -0,0 +1,48 @@
+#!/bin/sh
+
+die () {
+    echo "$1" >&2
+    exit 1
+}
+
+# If source not found, download it with dnf
+if [ ! -d ./source ]; then
+    # Extract source from srpm
+    dnf download --source jq && \
+    rpm2cpio jq*.rpm|cpio -id && \
+    mkdir source && \
+    tar -zxf jq-*.tar.gz -C source --strip-components=1
+    if [ $? != 0 ]; then
+        echo "Failed to download upstream tests"
+        exit 1
+    fi
+fi
+
+pushd ./source || die "missing source directory"
+rm -f jq tests/*.log 2>/dev/null
+ln -s /usr/bin/jq || die "failed to link jq binary"
+
+FAIL=0
+
+# run the tests
+# List of tests is taken from Makefile
+TESTS="tests/optionaltest tests/mantest tests/jqtest tests/onigtest tests/shtest tests/utf8test tests/base64test"
+
+for t in $TESTS; do
+    echo -n "Test $t ... "
+    ./${t} >"${t}.log" 2>&1
+    RET=$?
+    if [ $RET = 0 ]; then
+        echo "ok"
+    else
+        echo "failed"
+        echo "-------------------- ${t}.log start -----------------------------"
+        cat "${t}.log"
+        echo "-------------------- ${t}.log end -----------------------------"
+        FAIL=1
+    fi
+done
+
+popd # exit SOURCE_DIR
+
+exit $FAIL

tests/upstream/main.fmf

@@ -0,0 +1,11 @@
+summary: Run jq gating tests
+require:
+  - wget
+  - dnf-utils
+  - gcc
+  - jq
+  - jq-devel
+  - valgrind
+  - diffutils
+test: ./jqtests.sh
+duration: 30m