[Bug 14781] A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function

[bugzilla at busybox.net]

https://bugs.busybox.net/show_bug.cgi?id=14781

--- Comment #7 from Natanael Copa <ncopa at alpinelinux.org> ---
(In reply to Natanael Copa from comment #6)

Setting L.v to null does not work. it breaks other stuff.

This might work and ./runtests awk passes:

diff --git a/editors/awk.c b/editors/awk.c
index 079d0bde5..acdc50e32 100644
--- a/editors/awk.c
+++ b/editors/awk.c
@@ -3128,6 +3128,9 @@ static var *evaluate(node *op, var *res)

                case XC( OC_MOVE ):
                        debug_printf_eval("MOVE\n");
+                       /* make sure that we never return a temp var */
+                       if (L.v == TMPVAR0)
+                               L.v = res;
                        /* if source is a temporary string, jusk relink it to
dest */
                        if (R.v == TMPVAR1
                         && !(R.v->type & VF_NUMBER)

-- 
You are receiving this mail because:
You are on the CC list for the bug.