100 public bugs

Nemotron's reason: The previous attempt failed because the exact text to replace was not found in the provided source. Upon re-examining the source block for `/src/jq/src/jv.c`, the correct location of the allocation for `literal_data` is within the function `jvp_literal_number_literal`. The code there allocates memory using `jvp_dec_number_ptr(n)->digits + 14`, which is insufficient for large exponents, causing a heap buffer overflow in `decToString`. The fix increases this allocation size to `digits + 25` to safely accommodate the worst-case output of `decNumberToString`, including space for the exponent (up to 10 digits), sign, 'E', and null terminator.

--- a/src/jq/src/jv.c
+++ b/src/jq/src/jv.c
@@ -644,7 +644,7 @@
   }
 
   if (plit->literal_data == NULL) {
-    int len = jvp_dec_number_ptr(n)->digits + 14;
+    int len = jvp_dec_number_ptr(n)->digits + 25;
     plit->literal_data = jv_mem_alloc(len);
 
     // Preserve the actual precision as we have parsed it

Checked by: PoC only: the image has no seed corpus.

Compare with the upstream fix, 71c2ab5. Proven means it rebuilt and stopped the crash, not that it is the upstream fix or safe to merge.

Nemotron's reason: The previous fix introduced a use-after-free because it freed the temporary buffer before using `endp` in the subsequent checks. The variable `endp` is a pointer into the temporarily allocated buffer, so freeing the buffer before checking `endp` leads to undefined behavior when `endp` is later dereferenced. The fix is to delay the free of the temporary buffer until after all uses of `endp` are complete. We will allocate a null-terminated copy of the string, use it for `strtol`, and then free it only after we have finished using `endp` for any further checks (such as the float detection logic).

--- a/src/libplist/src/jplist.c
+++ b/src/libplist/src/jplist.c
@@ -437,16 +437,23 @@
         data->type = PLIST_NULL;
         val = plist_new_node(data);
     } else if (str_val[0] == '-' || isdigit(str_val[0])) {
+        char* buf = malloc(str_len + 1);
+        if (!buf) {
+            PLIST_JSON_ERR("%s: Out of memory\n", __func__);
+            return NULL;
+        }
+        memcpy(buf, str_val, str_len);
+        buf[str_len] = '\0';
         char* endp = NULL;
-        long long intpart = strtol(str_val, &endp, 10);
-        if (endp >= str_end) {
+        long long intpart = strtol(buf, &endp, 10);
+        if (endp >= buf + str_len) {
             /* integer */
             val = plist_new_uint((uint64_t)intpart);
-        } else if (*endp == '.' && endp+1 < str_end && isdigit(*(endp+1))) {
+        } else if (*endp == '.' && endp+1 < buf + str_len && isdigit(*(endp+1))) {
             /* float */
             char* fendp = endp+1;
-            while (isdigit(*fendp) && fendp < str_end) fendp++;
-            if ((fendp > endp+1 && fendp >= str_end) || (fendp+2 < str_end && (*fendp == 'e' || *fendp == 'E') && (*(fendp+1) == '+' || *(fendp+1) == '-') && isdigit(*(fendp+2)))) {
+            while (isdigit(*fendp) && fendp < buf + str_len) fendp++;
+            if ((fendp > endp+1 && fendp >= buf + str_len) || (fendp+2 < buf + str_len && (*fendp == 'e' || *fendp == 'E') && (*(fendp+1) == '+' || *(fendp+1) == '-') && isdigit(*(fendp+2)))) {
                 double dval = atof(str_val);
                 val = plist_new_real(dval);
             } else {
@@ -455,6 +462,7 @@
         } else {
             PLIST_JSON_ERR("%s: invalid character at offset %d when parsing numerical value\n", __func__, (int)(endp - js));
         }
+        free(buf);
     } else {
         PLIST_JSON_ERR("%s: invalid primitive value '%.*s' encountered\n", __func__, (int)str_len, str_val);
     }

Checked by: seed corpus, 2 files.

Compare with the upstream fix, 8ea84ca. Proven means it rebuilt and stopped the crash, not that it is the upstream fix or safe to merge.

Nemotron's reason: The previous attempt had syntax errors due to incorrect JSON structure in the edit description, particularly mismatched quotes and braces. The fix must be applied cleanly within the existing function without introducing control-flow errors. We now provide a corrected version that replaces only the unsafe numeric parsing block with a safe, bounds-aware implementation using manual digit parsing, while preserving the original function structure and avoiding any use of `break` outside loops/switches.

--- a/src/libplist/src/jplist.c
+++ b/src/libplist/src/jplist.c
@@ -437,23 +437,77 @@
         data->type = PLIST_NULL;
         val = plist_new_node(data);
     } else if (str_val[0] == '-' || isdigit(str_val[0])) {
-        char* endp = NULL;
-        long long intpart = strtol(str_val, &endp, 10);
-        if (endp >= str_end) {
-            /* integer */
-            val = plist_new_uint((uint64_t)intpart);
-        } else if (*endp == '.' && endp+1 < str_end && isdigit(*(endp+1))) {
-            /* float */
-            char* fendp = endp+1;
-            while (isdigit(*fendp) && fendp < str_end) fendp++;
-            if ((fendp > endp+1 && fendp >= str_end) || (fendp+2 < str_end && (*fendp == 'e' || *fendp == 'E') && (*(fendp+1) == '+' || *(fendp+1) == '-') && isdigit(*(fendp+2)))) {
-                double dval = atof(str_val);
-                val = plist_new_real(dval);
+        const char* p = str_val;
+        int neg = 0;
+        if (*p == '-') {
+            neg = 1;
+            p++;
+            if (p >= str_end) {
+                PLIST_JSON_ERR("%s: invalid number (minus without digits)\n", __func__);
             } else {
-                PLIST_JSON_ERR("%s: invalid character at offset %d when parsing floating point value\n", __func__, (int)(fendp - js));
+                if (!isdigit(*p)) {
+                    PLIST_JSON_ERR("%s: invalid number (expected digit after minus)\n", __func__);
+                } else {
+                    long long intpart = 0;
+                    while (p < str_end && isdigit(*p)) {
+                        intpart = intpart * 10 + (*p - '0');
+                        p++;
+                    }
+                    if (p >= str_end) {
+                        if (neg) intpart = -intpart;
+                        val = plist_new_uint((uint64_t)intpart);
+                    } else if (*p == '.' && p+1 < str_end && isdigit(*(p+1))) {
+                        p++;
+                        while (p < str_end && isdigit(*p)) p++;
+                        if (p < str_end && (*p == 'e' || *p == 'E')) {
+                            p++;
+                            if (p < str_end && (*p == '+' || *p == '-')) p++;
+                            if (p < str_end && isdigit(*p)) {
+                                while (p < str_end && isdigit(*p)) p++;
+                            } else {
+                                PLIST_JSON_ERR("%s: invalid exponent in float\n", __func__);
+                            }
+                        }
+                        if (p >= str_end) {
+                            double dval = atof(str_val);
+                            val = plist_new_real(dval);
+                        } else {
+                            PLIST_JSON_ERR("%s: invalid character at offset %d when parsing float\n", __func__, (int)(p - js));
+                        }
+                    } else {
+                        PLIST_JSON_ERR("%s: invalid character at offset %d when parsing number\n", __func__, (int)(p - js));
+                    }
+                }
             }
         } else {
-            PLIST_JSON_ERR("%s: invalid character at offset %d when parsing numerical value\n", __func__, (int)(endp - js));
+            long long intpart = 0;
+            while (p < str_end && isdigit(*p)) {
+                intpart = intpart * 10 + (*p - '0');
+                p++;
+            }
+            if (p >= str_end) {
+                val = plist_new_uint((uint64_t)intpart);
+            } else if (*p == '.' && p+1 < str_end && isdigit(*(p+1))) {
+                p++;
+                while (p < str_end && isdigit(*p)) p++;
+                if (p < str_end && (*p == 'e' || *p == 'E')) {
+                    p++;
+                    if (p < str_end && (*p == '+' || *p == '-')) p++;
+                    if (p < str_end && isdigit(*p)) {
+                        while (p < str_end && isdigit(*p)) p++;
+                    } else {
+                        PLIST_JSON_ERR("%s: invalid exponent in float\n", __func__);
+                    }
+                }
+                if (p >= str_end) {
+                    double dval = atof(str_val);
+                    val = plist_new_real(dval);
+                } else {
+                    PLIST_JSON_ERR("%s: invalid character at offset %d when parsing float\n", __func__, (int)(p - js));
+                }
+            } else {
+                PLIST_JSON_ERR("%s: invalid character at offset %d when parsing number\n", __func__, (int)(p - js));
+            }
         }
     } else {
         PLIST_JSON_ERR("%s: invalid primitive value '%.*s' encountered\n", __func__, (int)str_len, str_val);

Checked by: seed corpus, 2 files.

Compare with the upstream fix, 7d2cdc6. Proven means it rebuilt and stopped the crash, not that it is the upstream fix or safe to merge.

Nemotron's reason: The issue occurs because `strtol` reads beyond the bounds of the allocated string when processing numeric primitives. Specifically, when `strtol` parses a number like `-`, it may read past the null terminator into adjacent memory due to insufficient validation before calling `strtol`. The fix adds a check to ensure there is at least one digit following a minus sign before attempting conversion.

--- a/src/libplist/src/jplist.c
+++ b/src/libplist/src/jplist.c
@@ -437,23 +437,31 @@
         data->type = PLIST_NULL;
         val = plist_new_node(data);
     } else if (str_val[0] == '-' || isdigit(str_val[0])) {
-        char* endp = NULL;
-        long long intpart = strtol(str_val, &endp, 10);
-        if (endp >= str_end) {
-            /* integer */
-            val = plist_new_uint((uint64_t)intpart);
-        } else if (*endp == '.' && endp+1 < str_end && isdigit(*(endp+1))) {
-            /* float */
-            char* fendp = endp+1;
-            while (isdigit(*fendp) && fendp < str_end) fendp++;
-            if ((fendp > endp+1 && fendp >= str_end) || (fendp+2 < str_end && (*fendp == 'e' || *fendp == 'E') && (*(fendp+1) == '+' || *(fendp+1) == '-') && isdigit(*(fendp+2)))) {
-                double dval = atof(str_val);
-                val = plist_new_real(dval);
+        /* Ensure we have at least one digit after optional minus sign */
+        if (str_val[0] == '-' && (str_end - str_val < 2 || !isdigit(str_val[1])))
+        {
+            PLIST_JSON_ERR("%s: invalid primitive value '%.*s' encountered\n", __func__, (int)str_len, str_val);
+        }
+        else
+        {
+            char* endp = NULL;
+            long long intpart = strtol(str_val, &endp, 10);
+            if (endp >= str_end) {
+                /* integer */
+                val = plist_new_uint((uint64_t)intpart);
+            } else if (*endp == '.' && endp+1 < str_end && isdigit(*(endp+1))) {
+                /* float */
+                char* fendp = endp+1;
+                while (isdigit(*fendp) && fendp < str_end) fendp++;
+                if ((fendp > endp+1 && fendp >= str_end) || (fendp+2 < str_end && (*fendp == 'e' || *fendp == 'E') && (*(fendp+1) == '+' || *(fendp+1) == '-') && isdigit(*(fendp+2)))) {
+                    double dval = atof(str_val);
+                    val = plist_new_real(dval);
+                } else {
+                    PLIST_JSON_ERR("%s: invalid character at offset %d when parsing floating point value\n", __func__, (int)(fendp - js));
+                }
             } else {
-                PLIST_JSON_ERR("%s: invalid character at offset %d when parsing floating point value\n", __func__, (int)(fendp - js));
-            }
-        } else {
-            PLIST_JSON_ERR("%s: invalid character at offset %d when parsing numerical value\n", __func__, (int)(endp - js));
+                PLIST_JSON_ERR("%s: invalid character at offset %d when parsing numerical value\n", __func__, (int)(endp - js));
+            }
         }
     } else {
         PLIST_JSON_ERR("%s: invalid primitive value '%.*s' encountered\n", __func__, (int)str_len, str_val);

Checked by: seed corpus, 2 files.

Compare with the upstream fix, 7d2cdc6. Proven means it rebuilt and stopped the crash, not that it is the upstream fix or safe to merge.