summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorNicolas Williams <nico@cryptonector.com>2021-10-21 00:10:47 -0500
committerNicolas Williams <nico@cryptonector.com>2021-10-24 16:23:26 -0500
commit582717a7b4af6ce0e231b9aee090107235ef2d0f (patch)
treeb6b5b56c5aab6918c6e19c9154800ffad7edd2b8
parent07dc653ae151a8320646a1c955839fb88d4a5546 (diff)
downloadjq-582717a7b4af6ce0e231b9aee090107235ef2d0f.tar.gz
Fix crash in LOADVN when stack grows
This `stack_push()` call in LOADVN invalidates `var`: jv* var = frame_local_var(jq, v, level); jv_free(stack_popn(jq)); ------>stack_push(jq, *var); *var = jv_null(); ^^^^^^ We have to re-compute `var`: jv* var = frame_local_var(jq, v, level); jv_free(stack_popn(jq)); stack_push(jq, *var); ------>var = frame_local_var(jq, v, level); *var = jv_null();
-rw-r--r--src/execute.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/src/execute.c b/src/execute.c
index fd2ab2c..d840582 100644
--- a/src/execute.c
+++ b/src/execute.c
@@ -561,7 +561,11 @@ jv jq_next(jq_state *jq) {
printf(" (%d)\n", jv_get_refcnt(*var));
}
jv_free(stack_popn(jq));
+
+ // This `stack_push()` invalidates the `var` reference, so
stack_push(jq, *var);
+ // we have to re-resolve `var` before we can set it to null
+ var = frame_local_var(jq, v, level);
*var = jv_null();
break;
}