Fix CVE-2015-8863 (Off-by-one error in the tokenadd function in
jv_parse.c in jq allows remote attackers to cause a denial of service
(crash) via a long JSON-encoded number, which triggers a heap-based
buffer overflow):

<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8863>

Copied from upstream code repository:

<https://github.com/stedolan/jq/commit/8eb1367ca44e772963e704a700ef72ae2e12babd>

From 8eb1367ca44e772963e704a700ef72ae2e12babd Mon Sep 17 00:00:00 2001
From: Nicolas Williams <nico@cryptonector.com>
Date: Sat, 24 Oct 2015 17:24:57 -0500
Subject: [PATCH] Heap buffer overflow in tokenadd() (fix #105)

This was an off-by one: the NUL terminator byte was not allocated on
resize.  This was triggered by JSON-encoded numbers longer than 256
bytes.
---
 jv_parse.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/jv_parse.c b/jv_parse.c
index 3102ed4..84245b8 100644
--- a/jv_parse.c
+++ b/jv_parse.c
@@ -383,7 +383,7 @@ static pfunc stream_token(struct jv_parser* p, char ch) {
 
 static void tokenadd(struct jv_parser* p, char c) {
   assert(p->tokenpos <= p->tokenlen);
-  if (p->tokenpos == p->tokenlen) {
+  if (p->tokenpos >= (p->tokenlen - 1)) {
     p->tokenlen = p->tokenlen*2 + 256;
     p->tokenbuf = jv_mem_realloc(p->tokenbuf, p->tokenlen);
   }
@@ -485,7 +485,7 @@ static pfunc check_literal(struct jv_parser* p) {
     TRY(value(p, v));
   } else {
     // FIXME: better parser
-    p->tokenbuf[p->tokenpos] = 0; // FIXME: invalid
+    p->tokenbuf[p->tokenpos] = 0;
     char* end = 0;
     double d = jvp_strtod(&p->dtoa, p->tokenbuf, &end);
     if (end == 0 || *end != 0)
6ec980e002296440c2aba07f32d'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/log/?id=cfc7e2592dc6d6ec980e002296440c2aba07f32d'>root</a>/<a href='/guix/log/tests?id=cfc7e2592dc6d6ec980e002296440c2aba07f32d'>tests</a>/<a href='/guix/log/tests/guix-gc.sh?id=cfc7e2592dc6d6ec980e002296440c2aba07f32d'>guix-gc.sh</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/tests/guix-gc.sh?id=cfc7e2592dc6d6ec980e002296440c2aba07f32d&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2019-04-10 17:09:47 +0200'>2019-04-10</span></td><td><a href='/guix/commit/tests/guix-gc.sh?id=bacf980c76c94e7bda86220ca4bf662d0e34a45a'>guix gc: Add '--list-roots'.</a><span class='msg-avail'>...<span class='msg-tooltip'>* guix/scripts/gc.scm (show-help, %options): Add '--list-roots'.
(guix-gc)[list-roots]: New procedure.
Handle '--list-roots'.
* tests/guix-gc.sh: Test it.
* doc/guix.texi (Invoking guix gc): Document it.
</span></span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2018-03-27 14:51:44 +0200'>2018-03-27</span></td><td><a href='/guix/commit/tests/guix-gc.sh?id=8980eea5ab6f89e7649d9abf0be2a9d49156f7d2'>guix gc: Add '--derivers'.</a><span class='msg-avail'>...<span class='msg-tooltip'>* guix/scripts/gc.scm (show-help, %options): Add '--derivers'.
(guix-gc): Handle 'list-derivers'.
* tests/guix-gc.sh: Add test.
* doc/guix.texi (Invoking guix gc): Document it.
</span></span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2017-12-18 23:17:30 +0100'>2017-12-18</span></td><td><a href='/guix/commit/tests/guix-gc.sh?id=3caab236c49012643ab46afd7e82a287ec413ee8'>guix gc: '--verify=foo' is reported as an error.</a><span class='msg-avail'>...<span class='msg-tooltip'>Fixes &lt;https://bugs.gnu.org/29761&gt;.
Reported by Martin Castillo &lt;castilma@uni-bremen.de&gt;.

* guix/scripts/gc.scm (argument-&gt;verify-options): New procedure.
(%options) ["verify"]: Adjust to use it.
* tests/guix-gc.sh: Add test.
</span></span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2017-11-13 10:10:13 +0100'>2017-11-13</span></td><td><a href='/guix/commit/tests/guix-gc.sh?id=ff23b47dbee038236386ddc2ed2fff4c77ad3aa1'>tests: 'guix-gc.sh' passes even when 'out' or 'drv' are defined as env vars.</a><span class='msg-avail'>...<span class='msg-tooltip'>This fixes a test failure exhibited by
fb17a89912c2a3738dae716e30481c11e1c6f0ac whereby assignments to 'out' in
guix-gc.sh would go to the 'out' environment variable, when it exists,
which in turn prevents garbage collection of $out.

* tests/guix-gc.sh: Add 'unset' invocations.
</span></span></td><td>Ludovic Courtès</td></tr>