openclaw/tqma6-yocto-mirror
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Complete Yocto mirror with license table for TQMa6UL (2038-compliance)

Browse Source 
- 264 license table entries with exact download URLs (224/264 resolved)
- Complete sources/ directory with all BitBake recipes
- Build configuration: tqma6ul-multi-mba6ulx, spaetzle (musl)
- Full traceability for Softwarefreigabeantrag
- GCC 13.4.0, Linux 6.6.102, U-Boot 2023.04, musl 1.2.4
- License distribution: GPL-2.0 (24), MIT (23), GPL-2.0+ (18), BSD-3 (16)
This commit is contained in:
Siggi (OpenClaw Agent)
2026-03-01 20:58:18 +00:00
commit 16accb6b24
15086 changed files with 1292356 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

233
sources/meta-openembedded/meta-oe/recipes-devtools/jq/jq/CVE-2024-23337.patch Normal file
View File

@@ -0,0 +1,233 @@
From d9237e3d607f946fe74540efa42a2eacca2a6fbd Mon Sep 17 00:00:00 2001
From: itchyny <itchyny@cybozu.co.jp>
Date: Wed, 21 May 2025 07:45:00 +0900
Subject: [PATCH] Fix signed integer overflow in jvp_array_write and
jvp_object_rehash
This commit fixes signed integer overflow and SEGV issues on growing
arrays and objects. The size of arrays and objects is now limited to
`536870912` (`0x20000000`). This fixes CVE-2024-23337 and fixes #3262.
(cherry picked from commit de21386681c0df0104a99d9d09db23a9b2a78b1e)
Signed-off-by: Roland Kovacs <roland.kovacs@est.tech>
---
src/jv.c | 57 ++++++++++++++++++++++++++++++++++++++++-----------
src/jv_aux.c | 9 ++++----
tests/jq.test | 4 ++++
3 files changed, 54 insertions(+), 16 deletions(-)
diff --git a/src/jv.c b/src/jv.c
index 34573b8..15990f1 100644
--- a/src/jv.c
+++ b/src/jv.c
@@ -1001,6 +1001,11 @@ jv jv_array_set(jv j, int idx, jv val) {
jv_free(val);
return jv_invalid_with_msg(jv_string("Out of bounds negative array index"));
}
+ if (idx > (INT_MAX >> 2) - jvp_array_offset(j)) {
+ jv_free(j);
+ jv_free(val);
+ return jv_invalid_with_msg(jv_string("Array index too large"));
+ }
// copy/free of val,j coalesced
jv* slot = jvp_array_write(&j, idx);
jv_free(*slot);
@@ -1020,6 +1025,7 @@ jv jv_array_concat(jv a, jv b) {
// FIXME: could be faster
jv_array_foreach(b, i, elem) {
a = jv_array_append(a, elem);
+ if (!jv_is_valid(a)) break;
}
jv_free(b);
return a;
@@ -1283,15 +1289,22 @@ jv jv_string_indexes(jv j, jv k) {
assert(JVP_HAS_KIND(k, JV_KIND_STRING));
const char *jstr = jv_string_value(j);
const char *idxstr = jv_string_value(k);
- const char *p;
+ const char *p, *lp;
int jlen = jv_string_length_bytes(jv_copy(j));
int idxlen = jv_string_length_bytes(jv_copy(k));
jv a = jv_array();
if (idxlen != 0) {
- p = jstr;
+ int n = 0;
+ p = lp = jstr;
while ((p = _jq_memmem(p, (jstr + jlen) - p, idxstr, idxlen)) != NULL) {
- a = jv_array_append(a, jv_number(p - jstr));
+ while (lp < p) {
+ lp += jvp_utf8_decode_length(*lp);
+ n++;
+ }
+
+ a = jv_array_append(a, jv_number(n));
+ if (!jv_is_valid(a)) break;
p++;
}
}
@@ -1314,14 +1327,17 @@ jv jv_string_split(jv j, jv sep) {
if (seplen == 0) {
int c;
- while ((jstr = jvp_utf8_next(jstr, jend, &c)))
+ while ((jstr = jvp_utf8_next(jstr, jend, &c))) {
a = jv_array_append(a, jv_string_append_codepoint(jv_string(""), c));
+ if (!jv_is_valid(a)) break;
+ }
} else {
for (p = jstr; p < jend; p = s + seplen) {
s = _jq_memmem(p, jend - p, sepstr, seplen);
if (s == NULL)
s = jend;
a = jv_array_append(a, jv_string_sized(p, s - p));
+ if (!jv_is_valid(a)) break;
// Add an empty string to denote that j ends on a sep
if (s + seplen == jend && seplen != 0)
a = jv_array_append(a, jv_string(""));
@@ -1339,8 +1355,10 @@ jv jv_string_explode(jv j) {
const char* end = i + len;
jv a = jv_array_sized(len);
int c;
- while ((i = jvp_utf8_next(i, end, &c)))
+ while ((i = jvp_utf8_next(i, end, &c))) {
a = jv_array_append(a, jv_number(c));
+ if (!jv_is_valid(a)) break;
+ }
jv_free(j);
return a;
}
@@ -1614,10 +1632,13 @@ static void jvp_object_free(jv o) {
}
}
-static jv jvp_object_rehash(jv object) {
+static int jvp_object_rehash(jv *objectp) {
+ jv object = *objectp;
assert(JVP_HAS_KIND(object, JV_KIND_OBJECT));
assert(jvp_refcnt_unshared(object.u.ptr));
int size = jvp_object_size(object);
+ if (size > INT_MAX >> 2)
+ return 0;
jv new_object = jvp_object_new(size * 2);
for (int i=0; i<size; i++) {
struct object_slot* slot = jvp_object_get_slot(object, i);
@@ -1630,7 +1651,8 @@ static jv jvp_object_rehash(jv object) {
}
// references are transported, just drop the old table
jv_mem_free(jvp_object_ptr(object));
- return new_object;
+ *objectp = new_object;
+ return 1;
}
static jv jvp_object_unshare(jv object) {
@@ -1659,27 +1681,32 @@ static jv jvp_object_unshare(jv object) {
return new_object;
}
-static jv* jvp_object_write(jv* object, jv key) {
+static int jvp_object_write(jv* object, jv key, jv **valpp) {
*object = jvp_object_unshare(*object);
int* bucket = jvp_object_find_bucket(*object, key);
struct object_slot* slot = jvp_object_find_slot(*object, key, bucket);
if (slot) {
// already has the key
jvp_string_free(key);
- return &slot->value;
+ *valpp = &slot->value;
+ return 1;
}
slot = jvp_object_add_slot(*object, key, bucket);
if (slot) {
slot->value = jv_invalid();
} else {
- *object = jvp_object_rehash(*object);
+ if (!jvp_object_rehash(object)) {
+ *valpp = NULL;
+ return 0;
+ }
bucket = jvp_object_find_bucket(*object, key);
assert(!jvp_object_find_slot(*object, key, bucket));
slot = jvp_object_add_slot(*object, key, bucket);
assert(slot);
slot->value = jv_invalid();
}
- return &slot->value;
+ *valpp = &slot->value;
+ return 1;
}
static int jvp_object_delete(jv* object, jv key) {
@@ -1779,7 +1806,11 @@ jv jv_object_set(jv object, jv key, jv value) {
assert(JVP_HAS_KIND(object, JV_KIND_OBJECT));
assert(JVP_HAS_KIND(key, JV_KIND_STRING));
// copy/free of object, key, value coalesced
- jv* slot = jvp_object_write(&object, key);
+ jv* slot;
+ if (!jvp_object_write(&object, key, &slot)) {
+ jv_free(object);
+ return jv_invalid_with_msg(jv_string("Object too big"));
+ }
jv_free(*slot);
*slot = value;
return object;
@@ -1804,6 +1835,7 @@ jv jv_object_merge(jv a, jv b) {
assert(JVP_HAS_KIND(a, JV_KIND_OBJECT));
jv_object_foreach(b, k, v) {
a = jv_object_set(a, k, v);
+ if (!jv_is_valid(a)) break;
}
jv_free(b);
return a;
@@ -1823,6 +1855,7 @@ jv jv_object_merge_recursive(jv a, jv b) {
jv_free(elem);
a = jv_object_set(a, k, v);
}
+ if (!jv_is_valid(a)) break;
}
jv_free(b);
return a;
diff --git a/src/jv_aux.c b/src/jv_aux.c
index 6004799..bbe1c0d 100644
--- a/src/jv_aux.c
+++ b/src/jv_aux.c
@@ -193,18 +193,19 @@ jv jv_set(jv t, jv k, jv v) {
if (slice_len < insert_len) {
// array is growing
int shift = insert_len - slice_len;
- for (int i = array_len - 1; i >= end; i--) {
+ for (int i = array_len - 1; i >= end && jv_is_valid(t); i--) {
t = jv_array_set(t, i + shift, jv_array_get(jv_copy(t), i));
}
} else if (slice_len > insert_len) {
// array is shrinking
int shift = slice_len - insert_len;
- for (int i = end; i < array_len; i++) {
+ for (int i = end; i < array_len && jv_is_valid(t); i++) {
t = jv_array_set(t, i - shift, jv_array_get(jv_copy(t), i));
}
- t = jv_array_slice(t, 0, array_len - shift);
+ if (jv_is_valid(t))
+ t = jv_array_slice(t, 0, array_len - shift);
}
- for (int i=0; i < insert_len; i++) {
+ for (int i = 0; i < insert_len && jv_is_valid(t); i++) {
t = jv_array_set(t, start + i, jv_array_get(jv_copy(v), i));
}
jv_free(v);
diff --git a/tests/jq.test b/tests/jq.test
index d052b22..22bfd3a 100644
--- a/tests/jq.test
+++ b/tests/jq.test
@@ -198,6 +198,10 @@ null
[0,1,2]
[0,5,2]
+try (.[999999999] = 0) catch .
+null
+"Array index too large"
+
#
# Multiple outputs, iteration
#

79
sources/meta-openembedded/meta-oe/recipes-devtools/jq/jq/CVE-2024-53427.patch Normal file
View File

@@ -0,0 +1,79 @@
From fa6131eb6e9d43e88e35982fa5f6049da2a77a87 Mon Sep 17 00:00:00 2001
From: itchyny <itchyny@cybozu.co.jp>
Date: Wed, 5 Mar 2025 07:43:54 +0900
Subject: [PATCH] Reject NaN with payload while parsing JSON
This commit drops support for parsing NaN with payload in JSON like
`NaN123` and fixes CVE-2024-53427. Other JSON extensions like `NaN` and
`Infinity` are still supported. Fixes #3023, fixes #3196, fixes #3246.
(cherry picked from commit a09a4dfd55e6c24d04b35062ccfe4509748b1dd3)
Signed-off-by: Roland Kovacs <roland.kovacs@est.tech>
---
src/jv.c | 9 +++++++++
tests/jq.test | 14 ++++++++++----
tests/shtest | 5 -----
3 files changed, 19 insertions(+), 9 deletions(-)
diff --git a/src/jv.c b/src/jv.c
index e23d8ec..34573b8 100644
--- a/src/jv.c
+++ b/src/jv.c
@@ -589,6 +589,15 @@ static jv jvp_literal_number_new(const char * literal) {
jv_mem_free(n);
return JV_INVALID;
}
+ if (decNumberIsNaN(&n->num_decimal)) {
+ // Reject NaN with payload.
+ if (n->num_decimal.digits > 1 || *n->num_decimal.lsu != 0) {
+ jv_mem_free(n);
+ return JV_INVALID;
+ }
+ jv_mem_free(n);
+ return jv_number(NAN);
+ }
jv r = {JVP_FLAGS_NUMBER_LITERAL, 0, 0, JV_NUMBER_SIZE_INIT, {&n->refcnt}};
return r;
diff --git a/tests/jq.test b/tests/jq.test
index 7036df2..d052b22 100644
--- a/tests/jq.test
+++ b/tests/jq.test
@@ -1938,11 +1938,17 @@ tojson | fromjson
{"a":nan}
{"a":null}
-# also "nan with payload" #2985
-fromjson | isnan
-"nan1234"
+# NaN with payload is not parsed
+.[] | try (fromjson | isnan) catch .
+["NaN","-NaN","NaN1","NaN10","NaN100","NaN1000","NaN10000","NaN100000"]
true
-
+true
+"Invalid numeric literal at EOF at line 1, column 4 (while parsing 'NaN1')"
+"Invalid numeric literal at EOF at line 1, column 5 (while parsing 'NaN10')"
+"Invalid numeric literal at EOF at line 1, column 6 (while parsing 'NaN100')"
+"Invalid numeric literal at EOF at line 1, column 7 (while parsing 'NaN1000')"
+"Invalid numeric literal at EOF at line 1, column 8 (while parsing 'NaN10000')"
+"Invalid numeric literal at EOF at line 1, column 9 (while parsing 'NaN100000')"
# calling input/0, or debug/0 in a test doesn't crash jq
diff --git a/tests/shtest b/tests/shtest
index 14aafbf..a471889 100755
--- a/tests/shtest
+++ b/tests/shtest
@@ -594,11 +594,6 @@ if ! x=$($JQ -n "1 # foo$cr + 2") || [ "$x" != 1 ]; then
exit 1
fi
-# CVE-2023-50268: No stack overflow comparing a nan with a large payload
-$VALGRIND $Q $JQ '1 != .' <<\EOF >/dev/null
-Nan4000
-EOF
-
# Allow passing the inline jq script before -- #2919
if ! r=$($JQ --args -rn -- '$ARGS.positional[0]' bar) || [ "$r" != bar ]; then
echo "passing the inline script after -- didn't work"

45
sources/meta-openembedded/meta-oe/recipes-devtools/jq/jq/CVE-2025-48060.patch Normal file
View File

@@ -0,0 +1,45 @@
From 35c08446e4bcd89e0e87e7750c68306d6c0e9ec5 Mon Sep 17 00:00:00 2001
From: itchyny <itchyny@cybozu.co.jp>
Date: Sat, 31 May 2025 11:46:40 +0900
Subject: [PATCH] Fix heap buffer overflow when formatting an empty string
The `jv_string_empty` did not properly null-terminate the string data,
which could lead to a heap buffer overflow. The test case of
GHSA-p7rr-28xf-3m5w (`0[""*0]`) was fixed by the commit dc849e9bb74a,
but another case (`0[[]|implode]`) was still vulnerable. This commit
ensures string data is properly null-terminated, and fixes CVE-2025-48060.
(cherry picked from commit c6e041699d8cd31b97375a2596217aff2cfca85b)
Signed-off-by: Roland Kovacs <roland.kovacs@est.tech>
---
src/jv.c | 1 +
tests/jq.test | 4 ++++
2 files changed, 5 insertions(+)
diff --git a/src/jv.c b/src/jv.c
index 15990f1..18dbb54 100644
--- a/src/jv.c
+++ b/src/jv.c
@@ -1125,6 +1125,7 @@ static jv jvp_string_empty_new(uint32_t length) {
jvp_string* s = jvp_string_alloc(length);
s->length_hashed = 0;
memset(s->data, 0, length);
+ s->data[length] = 0;
jv r = {JVP_FLAGS_STRING, 0, 0, 0, {&s->refcnt}};
return r;
}
diff --git a/tests/jq.test b/tests/jq.test
index 22bfd3a..ecb9116 100644
--- a/tests/jq.test
+++ b/tests/jq.test
@@ -2030,6 +2030,10 @@ map(try implode catch .)
[123,["a"],[nan]]
["implode input must be an array","string (\"a\") can't be imploded, unicode codepoint needs to be numeric","number (null) can't be imploded, unicode codepoint needs to be numeric"]
+try 0[implode] catch .
+[]
+"Cannot index number with string \"\""
+
# walk
walk(.)
{"x":0}

37
sources/meta-openembedded/meta-oe/recipes-devtools/jq/jq/run-ptest Executable file
View File

@@ -0,0 +1,37 @@
#!/bin/sh
JQ_LIB=@libdir@/jq
LOG="${JQ_LIB}/ptest/jq_ptest_$(date +%Y%m%d-%H%M%S).log"
# clean up the log file to avoid a file has the same name and has existing content
echo "" > ${LOG}
# The purpose of ptest is doing intergration test, so disable valgrind by default
# change PACKAGECOFIG to enable valgrind.
#export NO_VALGRIND=1
# The --enable-valgrind configure option for jq only can be used within Makefiles,
# and it cannot be utilized here since it also checks compile, which cannot be avoid
# Requested enhancement to jq: https://github.com/stedolan/jq/issues/2493
for test in optionaltest mantest jqtest onigtest shtest utf8test base64test; do
./tests/${test} >> ${LOG} 2>> ${LOG}
if [ $? -eq 0 ]; then
echo "PASS: ${test}"
echo "PASS: ${test}" >> ${LOG}
else
echo "FAIL: ${test}"
echo "FAIL: ${test}" >> ${LOG}
fi
done
passed=`grep PASS: ${LOG}|wc -l`
failed=`grep FAIL: ${LOG}|wc -l`
skipped=`grep SKIP: ${LOG}|wc -l`
all=$((passed + failed + skipped))
( echo "=== Test Summary ==="
echo "TOTAL: ${all}"
echo "PASSED: ${passed}"
echo "FAILED: ${failed}"
echo "SKIPPED: ${skipped}"
) | tee -a /${LOG}

49
sources/meta-openembedded/meta-oe/recipes-devtools/jq/jq_1.7.1.bb Normal file
View File

@@ -0,0 +1,49 @@
SUMMARY = "Lightweight and flexible command-line JSON processor"
DESCRIPTION = "jq is like sed for JSON data, you can use it to slice and \
filter and map and transform structured data with the same \
ease that sed, awk, grep and friends let you play with text."
HOMEPAGE = "https://jqlang.github.io/jq/"
BUGTRACKER = "https://github.com/jqlang/jq/issues"
SECTION = "utils"
LICENSE = "MIT"
LIC_FILES_CHKSUM = "file://COPYING;md5=488f4e0b04c0456337fb70d1ac1758ba"
GITHUB_BASE_URI = "https://github.com/jqlang/${BPN}/releases/"
SRC_URI = "${GITHUB_BASE_URI}/download/${BPN}-${PV}/${BPN}-${PV}.tar.gz \
file://run-ptest \
file://CVE-2024-23337.patch \
file://CVE-2024-53427.patch \
file://CVE-2025-48060.patch \
"
SRC_URI[sha256sum] = "478c9ca129fd2e3443fe27314b455e211e0d8c60bc8ff7df703873deeee580c2"
inherit autotools github-releases ptest
UPSTREAM_CHECK_REGEX = "releases/tag/${BPN}-(?P<pver>\d+(\.\d+)+)"
PACKAGECONFIG ?= "oniguruma"
PACKAGECONFIG[docs] = "--enable-docs,--disable-docs,ruby-native"
PACKAGECONFIG[maintainer-mode] = "--enable-maintainer-mode,--disable-maintainer-mode,flex-native bison-native"
PACKAGECONFIG[oniguruma] = "--with-oniguruma,--without-oniguruma,onig"
# enable if you want ptest running under valgrind
PACKAGECONFIG[valgrind] = "--enable-valgrind,--disable-valgrind,valgrind"
do_configure:append() {
sed -i -e "/^ac_cs_config=/ s:${WORKDIR}::g" ${B}/config.status
}
do_install_ptest() {
cp -rf ${S}/tests ${D}${PTEST_PATH}
cp -rf ${B}/.libs ${D}${PTEST_PATH}
# libjq.so.* is packaged in the main jq component, so remove it from ptest
rm -f ${D}${PTEST_PATH}/.libs/libjq.so.*
ln -sf ${bindir}/jq ${D}${PTEST_PATH}
if [ "${@bb.utils.contains('PACKAGECONFIG', 'valgrind', 'true', 'false', d)}" = "false" ]; then
sed -i 's:#export NO_VALGRIND=1:export NO_VALGRIND=1:g' ${D}${PTEST_PATH}/run-ptest
fi
# handle multilib
sed -i s:@libdir@:${libdir}:g ${D}${PTEST_PATH}/run-ptest
}
BBCLASSEXTEND = "native"