[Bug 14781] A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function

[bugzilla at busybox.net]

https://bugs.busybox.net/show_bug.cgi?id=14781

--- Comment #6 from Natanael Copa <ncopa at alpinelinux.org> ---
Possible fix:

diff --git a/editors/awk.c b/editors/awk.c
index 079d0bde5..d68b8d4bc 100644
--- a/editors/awk.c
+++ b/editors/awk.c
@@ -2922,7 +2922,7 @@ static var *evaluate(node *op, var *res)
                if (opinfo & OF_RES2) {
                        R.v = evaluate(op->r.n, TMPVAR1);
                        //TODO: L.v may be invalid now, set L.v to NULL to
catch bugs?
-                       //L.v = NULL;
+                       L.v = NULL;
                        if (opinfo & OF_STR2) {
                                R.s = getvar_s(R.v);
                                debug_printf_eval("R.s:'%s'\n", R.s);
@@ -3128,6 +3128,8 @@ static var *evaluate(node *op, var *res)

                case XC( OC_MOVE ):
                        debug_printf_eval("MOVE\n");
+                       if (L.v == NULL)
+                               syntax_error(EMSG_POSSIBLE_ERROR);
                        /* if source is a temporary string, jusk relink it to
dest */
                        if (R.v == TMPVAR1
                         && !(R.v->type & VF_NUMBER)

-- 
You are receiving this mail because:
You are on the CC list for the bug.