Files
yq/pkg/yqlib
0374ad6b4b Fix stack overflow from circular alias in traverse (#2647)
go-yaml accepts cross-document alias references, which the YAML spec
forbids (anchors are scoped to a single document). When a nested
assignment targets such an alias, UpdateFrom copies the Alias field
between nodes, creating a self-referencing AliasNode. Both traverse()
and traverseArrayIndices() then follow this cycle indefinitely.

Extract resolveAliasChain(), which follows aliases iteratively with a
visited set and returns an error on cycles. Both traverse() and
traverseArrayIndices() now call it, eliminating the recursive alias
handling in both code paths.

Note: traverseMergeAnchor() also dereferences aliases (lines 358 and
371) but with single-step assignment, not recursion. A self-referencing
alias there falls through the kind switch silently rather than
crashing. Using resolveAliasChain() in that function would produce a
clear error instead of silently dropping the node.

Reproducer (stack overflow before this fix, returns error after):

    echo '&-- a
    ---
    *--' | yq eval-all '. = (.x = 1)'

Found by OSS-Fuzz via the lima project's FuzzEvaluateExpression target.
https://issues.oss-fuzz.com/issues/390467412

Signed-off-by: Jan Dubois <jan@jandubois.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-06 18:25:13 +10:00
..
2023-10-18 12:11:53 +11:00
2025-12-08 21:09:21 +11:00
2025-12-20 19:11:48 +11:00
2023-10-18 12:11:53 +11:00
2023-10-18 12:11:53 +11:00
2026-02-01 10:27:18 +11:00
2025-12-20 19:11:48 +11:00
2025-12-20 19:11:48 +11:00
2025-05-17 18:55:53 +10:00
2024-02-24 15:48:59 +11:00
2025-05-03 16:34:21 +10:00
2025-06-07 15:23:38 +10:00
2026-02-01 10:27:18 +11:00
2025-12-08 20:30:47 +11:00
2025-05-17 18:55:53 +10:00
2025-05-17 18:55:53 +10:00
2024-02-24 15:59:12 +11:00
2025-11-25 10:17:43 +11:00
2024-02-24 15:36:16 +11:00
2023-10-18 12:11:53 +11:00
2025-12-08 20:30:47 +11:00
2023-10-03 16:22:23 +11:00
2025-12-26 11:08:24 +11:00
2025-06-12 15:41:27 +10:00
2023-10-18 12:11:53 +11:00
2024-01-11 13:17:34 +11:00
2023-10-18 12:11:53 +11:00
2022-11-01 09:29:05 +11:00
2024-01-11 13:17:34 +11:00
2023-10-18 12:11:53 +11:00
2023-10-18 12:11:53 +11:00
2024-01-11 13:17:34 +11:00
2023-10-18 12:11:53 +11:00
2023-10-18 12:11:53 +11:00
2024-11-16 11:48:53 +11:00
2023-10-18 12:11:53 +11:00
2024-01-11 13:17:34 +11:00
2025-11-09 16:12:17 +11:00
2025-11-09 16:12:17 +11:00
2023-10-18 12:11:53 +11:00
2023-10-02 14:43:12 +11:00
2024-01-11 13:17:34 +11:00
2023-03-16 13:39:36 +11:00
2024-01-11 13:17:34 +11:00
2023-10-18 12:11:53 +11:00
2024-01-11 13:17:34 +11:00
2025-05-03 16:34:21 +10:00
2025-05-03 16:34:21 +10:00
2025-05-03 16:34:21 +10:00
2023-10-18 12:11:53 +11:00
2024-03-30 13:29:35 +11:00
2024-01-11 13:17:34 +11:00
2024-01-11 13:17:34 +11:00
2023-10-18 12:11:53 +11:00
2025-06-07 15:23:38 +10:00
2023-10-18 12:11:53 +11:00
2024-01-11 13:17:34 +11:00
2023-10-18 12:11:53 +11:00
2025-06-07 15:23:38 +10:00
2024-06-15 17:06:17 +10:00
2023-10-18 12:11:53 +11:00
2026-02-01 10:27:18 +11:00
2025-12-20 19:11:48 +11:00
2025-05-03 16:34:21 +10:00
2024-02-24 15:14:21 +11:00
2024-02-21 14:50:55 +11:00
2025-12-14 19:41:45 +11:00
2024-02-24 15:03:30 +11:00
2025-12-06 19:08:37 +11:00