Impact

Stack-buffer-overflow; jq 1.7 builds using decNumber.
Reproduce with

jq '1 != .' <<<Nan4000

oss-fuzz Recommended Security Severity: High

Patches

Allocate decNumberUnit to perform the comparison without overflow.

Workarounds

Upgrade to 1.7.1

References

1. https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64771
2. The same commit also introduces the UBSAN (signed overflow) bugs reported by #2968
   Reproduce with

   jq -n '1e999999999 > 1e-1147483646'