Skip to content

Commit 63b2d0f

Browse files
committed
Remove multiple calls to free when successively calling jq_reset.
`jq_reset` calls `jv_free` on the `exit_code` and the `error_message` stored on the jq state. However, it doesn't replace the actual instance of those members. This means that subsequent calls to `jq_reset` will call `jv_free` again on those members, which in turn may call `free` on the same pointer multiple times. Freeing the same pointer multiple times is undefined behavior and can cause heap corruption, which is how I spotted this issue. In practice, this issue only occurs when using a program that may `halt_error`, because that is when the `exit_code` and `error_message` are set to values other than `jv_invalid`. Subsequent attempts to call `jq_start` (which calls `jq_reset` internally) after hitting a `halt_error` can cause you to run into this issue. The changes simply reset the `exit_code` and the `error_message` to `jv_invalid` (the initial value set in `jq_init`) after they are freed.
1 parent 250475b commit 63b2d0f

File tree

1 file changed

+2
-0
lines changed

1 file changed

+2
-0
lines changed

src/execute.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -315,7 +315,9 @@ static void jq_reset(jq_state *jq) {
315315

316316
jq->halted = 0;
317317
jv_free(jq->exit_code);
318+
jq->exit_code = jv_invalid();
318319
jv_free(jq->error_message);
320+
jq->error_message = jv_invalid();
319321
if (jv_get_kind(jq->path) != JV_KIND_INVALID)
320322
jv_free(jq->path);
321323
jq->path = jv_null();

0 commit comments

Comments
 (0)