Repository navigation
Fix panic on negative slice indices that underflow after adjustment - #2646
Merged
Merged
Conversation
sliceArrayOperator adjusts negative indices by adding Content length,
but does not clamp the result. When the absolute value of a negative
index exceeds Content length (e.g. .[-99999:3] on a 3-element array),
the adjusted index remains negative and causes an out-of-bounds access
in the Content slice loop.
Extract the adjust-and-clamp logic into clampSliceIndex and use it for
both index positions.
Reproducer (panics before this fix, returns full array after):
echo '[a, b, c]' | yq '.[-99999:3]'
Found by OSS-Fuzz via the lima project's FuzzEvaluateExpression target.
https://issues.oss-fuzz.com/issues/438776028
Signed-off-by: Jan Dubois <jan@jandubois.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Owner
|
Love your work @jandubois |
tmeijn
pushed a commit
to tmeijn/dotfiles
that referenced
this pull request
May 7, 2026
This MR contains the following updates: | Package | Update | Change | |---|---|---| | [mikefarah/yq](https://github.com/mikefarah/yq) | minor | `v4.52.5` → `v4.53.2` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>mikefarah/yq (mikefarah/yq)</summary> ### [`v4.53.2`](https://github.com/mikefarah/yq/releases/tag/v4.53.2) [Compare Source](mikefarah/yq@v4.52.5...v4.53.2) - Releases and tags now signed and immutable! - Add system(command; args) operator (disabled by default) ([#​2640](mikefarah/yq#2640)) - TOML encoder: prefer readable table sections over inline tables ([#​2649](mikefarah/yq#2649)) - Fix TOML encoder to quote keys containing special characters ([#​2648](mikefarah/yq#2648)) - Add string slicing support ([#​2639](mikefarah/yq#2639)) - Fix findInArray misuse on MappingNodes in equality and contains ([#​2645](mikefarah/yq#2645)) Thanks [@​jandubois](https://github.com/jandubois)! - Fix panic on negative slice indices that underflow after adjustment ([#​2646](mikefarah/yq#2646)) Thanks [@​jandubois](https://github.com/jandubois)! - Fix stack overflow from circular alias in traverse ([#​2647](mikefarah/yq#2647)) Thanks [@​jandubois](https://github.com/jandubois)! - Fix panic and OOM in repeatString for large repeat counts ([#​2644](mikefarah/yq#2644)) Thanks [@​jandubois](https://github.com/jandubois)! - Bumped dependencies </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMjcuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEyNy4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJSZW5vdmF0ZSBCb3QiLCJhdXRvbWF0aW9uOmJvdC1hdXRob3JlZCIsImRlcGVuZGVuY3ktdHlwZTo6bWlub3IiXX0=-->
eleboucher
pushed a commit
to eleboucher/runner
that referenced
this pull request
May 28, 2026
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [forgejo-runner-service-yq](https://github.com/mikefarah/yq) | minor | `v4.52.4` → `v4.53.2` | --- ### Release Notes <details> <summary>mikefarah/yq (forgejo-runner-service-yq)</summary> ### [`v4.53.2`](https://github.com/mikefarah/yq/releases/tag/v4.53.2) [Compare Source](mikefarah/yq@v4.52.5...v4.53.2) - Releases and tags now signed and immutable! - Add system(command; args) operator (disabled by default) ([#​2640](mikefarah/yq#2640)) - TOML encoder: prefer readable table sections over inline tables ([#​2649](mikefarah/yq#2649)) - Fix TOML encoder to quote keys containing special characters ([#​2648](mikefarah/yq#2648)) - Add string slicing support ([#​2639](mikefarah/yq#2639)) - Fix findInArray misuse on MappingNodes in equality and contains ([#​2645](mikefarah/yq#2645)) Thanks [@​jandubois](https://github.com/jandubois)! - Fix panic on negative slice indices that underflow after adjustment ([#​2646](mikefarah/yq#2646)) Thanks [@​jandubois](https://github.com/jandubois)! - Fix stack overflow from circular alias in traverse ([#​2647](mikefarah/yq#2647)) Thanks [@​jandubois](https://github.com/jandubois)! - Fix panic and OOM in repeatString for large repeat counts ([#​2644](mikefarah/yq#2644)) Thanks [@​jandubois](https://github.com/jandubois)! - Bumped dependencies ### [`v4.52.5`](https://github.com/mikefarah/yq/releases/tag/v4.52.5) [Compare Source](mikefarah/yq@v4.52.4...v4.52.5) - Fix: reset TOML decoder state between files ([#​2634](mikefarah/yq#2634)) thanks [@​terminalchai](https://github.com/terminalchai) - Fix: preserve original filename when using --front-matter ([#​2613](mikefarah/yq#2613)) thanks [@​cobyfrombrooklyn-bot](https://github.com/cobyfrombrooklyn-bot) - Fix typo in filename ([#​2611](mikefarah/yq#2611)) thanks [@​alexandear](https://github.com/alexandear) - Bumped dependencies </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE5NS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJLaW5kL0RlcGVuZGVuY3lVcGRhdGUiLCJydW4tZW5kLXRvLWVuZC10ZXN0cyJdfQ==--> Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1536
hbjydev
pushed a commit
to hbjydev/phoebe
that referenced
this pull request
Aug 27, 2026
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [yq](https://github.com/mikefarah/yq) | minor | `4.52.4` → `4.53.6` | --- >⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/141) for more information. --- ### Release Notes <details> <summary>mikefarah/yq (yq)</summary> ### [`v4.53.6`](https://github.com/mikefarah/yq/releases/tag/v4.53.6) [Compare Source](mikefarah/yq@v4.53.4...v4.53.6) - Fixing release build issue - Fixed line wrapping bug ([#​2824](mikefarah/yq#2824), [#​2823](mikefarah/yq#2823)) Thanks [@​mxey](https://github.com/mxey) - Bumped dependencies ### [`v4.53.4`](https://github.com/mikefarah/yq/releases/tag/v4.53.4) [Compare Source](mikefarah/yq@v4.53.3...v4.53.4) - Close input files after processing each one ([#​2796](mikefarah/yq#2796)) ([#​2808](mikefarah/yq#2808)) Thanks [@​MsfPablo](https://github.com/MsfPablo) - Fixed non string HCL string keys ([#​2795](mikefarah/yq#2795)) - Fixed heap allocation bug ([#​2809](mikefarah/yq#2809)) Thanks [@​MsfPablo](https://github.com/MsfPablo) - Fix deleting commented empty list YAML output ([#​2765](mikefarah/yq#2765)) Thanks [@​dpersek](https://github.com/dpersek) - Fix (has) return false for negative array indices ([#​2769](mikefarah/yq#2769)) Thanks [@​maximilize](https://github.com/maximilize) - Fix (sort): avoid int64 overflow comparing large integers ([#​2771](mikefarah/yq#2771)) Thanks [@​maximilize](https://github.com/maximilize) - Fix: preserve correct parent references in explode merge anchor reconstruction ([#​2730](mikefarah/yq#2730)) Thanks [@​vomba](https://github.com/vomba) - Improve Guard ExpressionParser initialization with sync.Once ([#​2789](mikefarah/yq#2789)) Thanks [@​arcaven](https://github.com/arcaven) - Fix: reject negative indent instead of panicking ([#​2746](mikefarah/yq#2746)) Thanks [@​StressTestor](https://github.com/StressTestor) - Fix: parse signed hex and octal integers ([#​2749](mikefarah/yq#2749)) Thanks [@​StressTestor](https://github.com/StressTestor) - Fix: skip UTF-8 BOM when processing front matter ([#​2751](mikefarah/yq#2751)) Thanks [@​StressTestor](https://github.com/StressTestor) - Fix !!merge tag regression for yq ([#​2705](mikefarah/yq#2705)) Thanks [@​W-Floyd](https://github.com/W-Floyd) - Default to yaml when a file's extension is not a recognised format ([#​2785](mikefarah/yq#2785)) Thanks [@​devthedevil](https://github.com/devthedevil) - Bumped dependencies ### [`v4.53.3`](https://github.com/mikefarah/yq/releases/tag/v4.53.3) [Compare Source](mikefarah/yq@v4.53.2...v4.53.3) - Add `--ini-preserve-quotes` flag for INI round-trip quote preservation ([#​2728](mikefarah/yq#2728)) Thanks [@​toller892](https://github.com/toller892)! - Fix: reset INI decoder state on init ([#​2719](mikefarah/yq#2719)) Thanks [@​xieby1](https://github.com/xieby1)! - Fix: decode properties array bracket paths ([#​2693](mikefarah/yq#2693)) Thanks [@​cyphercodes](https://github.com/cyphercodes)! - Fix: preserve floats with trailing zero when encoding YAML to JSON ([#​2701](mikefarah/yq#2701)) Thanks [@​ChrisJr404](https://github.com/ChrisJr404)! - Fix: JSON to TOML root scope and null handling ([#​2689](mikefarah/yq#2689)) Thanks [@​LovesAsuna](https://github.com/LovesAsuna)! - Fix: reset TOML decoder finished flag on Init for multi-doc evaluation ([#​2704](mikefarah/yq#2704)) Thanks [@​terminalchai](https://github.com/terminalchai)! - Fix: reset TOML decoder between files when evaluating all at once ([#​2685](mikefarah/yq#2685)) Thanks [@​terminalchai](https://github.com/terminalchai)! - Fix: preserve TOML inline table array scope ([#​2694](mikefarah/yq#2694)) Thanks [@​cyphercodes](https://github.com/cyphercodes)! - Fix: preserve empty TOML arrays in tables ([#​2686](mikefarah/yq#2686)) Thanks [@​cyphercodes](https://github.com/cyphercodes)! - Fix: TOML encoder uses inline tables for YAML FlowStyle mappings ([#​2687](mikefarah/yq#2687)) - Fix nested inline YAML merge explode ([#​2699](mikefarah/yq#2699)) Thanks [@​cyphercodes](https://github.com/cyphercodes)! - Fix repeatString overflow test on 32-bit platforms ([#​2680](mikefarah/yq#2680)) Thanks [@​jandubois](https://github.com/jandubois)! - Bumped dependencies ### [`v4.53.2`](https://github.com/mikefarah/yq/releases/tag/v4.53.2) [Compare Source](mikefarah/yq@v4.52.5...v4.53.2) - Releases and tags now signed and immutable! - Add system(command; args) operator (disabled by default) ([#​2640](mikefarah/yq#2640)) - TOML encoder: prefer readable table sections over inline tables ([#​2649](mikefarah/yq#2649)) - Fix TOML encoder to quote keys containing special characters ([#​2648](mikefarah/yq#2648)) - Add string slicing support ([#​2639](mikefarah/yq#2639)) - Fix findInArray misuse on MappingNodes in equality and contains ([#​2645](mikefarah/yq#2645)) Thanks [@​jandubois](https://github.com/jandubois)! - Fix panic on negative slice indices that underflow after adjustment ([#​2646](mikefarah/yq#2646)) Thanks [@​jandubois](https://github.com/jandubois)! - Fix stack overflow from circular alias in traverse ([#​2647](mikefarah/yq#2647)) Thanks [@​jandubois](https://github.com/jandubois)! - Fix panic and OOM in repeatString for large repeat counts ([#​2644](mikefarah/yq#2644)) Thanks [@​jandubois](https://github.com/jandubois)! - Bumped dependencies ### [`v4.52.5`](https://github.com/mikefarah/yq/releases/tag/v4.52.5) [Compare Source](mikefarah/yq@v4.52.4...v4.52.5) - Fix: reset TOML decoder state between files ([#​2634](mikefarah/yq#2634)) thanks [@​terminalchai](https://github.com/terminalchai) - Fix: preserve original filename when using --front-matter ([#​2613](mikefarah/yq#2613)) thanks [@​cobyfrombrooklyn-bot](https://github.com/cobyfrombrooklyn-bot) - Fix typo in filename ([#​2611](mikefarah/yq#2611)) thanks [@​alexandear](https://github.com/alexandear) - Bumped dependencies </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/London) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjAuMiIsInVwZGF0ZWRJblZlciI6IjQzLjI2MC4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9naXRodWItcmVsZWFzZSIsInR5cGUvbWlub3IiXX0=--> Reviewed-on: https://forgejo.hayden.moe/hayden/phoebe/pulls/363
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
sliceArrayOperatoradjusts negative indices by addingContentlength, but does not clamp the result. When the absolute value of a negative index exceedsContentlength (e.g. .[-99999:3] on a 3-element array), the adjusted index remains negative and causes an out-of-bounds access in theContentslice loop.Extract the adjust-and-clamp logic into
clampSliceIndexand use it for both index positions.Reproducer (panics before this fix, returns full array after):
Found by OSS-Fuzz via the lima project's FuzzEvaluateExpression target. https://issues.oss-fuzz.com/issues/438776028