[PATCH] awk: fix use after free (CVE-2023-42363)

[Denys Vlasenko]

Applied. Please try current git.

On Mon, May 20, 2024 at 6:05 PM Natanael Copa <ncopa at alpinelinux.org> wrote:
>
> Fixes https://bugs.busybox.net/show_bug.cgi?id=15865
>
> Signed-off-by: Natanael Copa <ncopa at alpinelinux.org>
> ---
>  editors/awk.c | 12 ++++++++----
>  1 file changed, 8 insertions(+), 4 deletions(-)
>
> diff --git a/editors/awk.c b/editors/awk.c
> index 0981c6735..122376935 100644
> --- a/editors/awk.c
> +++ b/editors/awk.c
> @@ -2981,10 +2981,6 @@ static var *evaluate(node *op, var *res)
>                                 /* yes, remember where Fields[] is */
>                                 old_Fields_ptr = Fields;
>                         }
> -                       if (opinfo & OF_STR1) {
> -                               L.s = getvar_s(L.v);
> -                               debug_printf_eval("L.s:'%s'\n", L.s);
> -                       }
>                         if (opinfo & OF_NUM1) {
>                                 L_d = getvar_i(L.v);
>                                 debug_printf_eval("L_d:%f\n", L_d);
> @@ -3014,6 +3010,14 @@ static var *evaluate(node *op, var *res)
>                         }
>                 }
>
> +               /* Must get L.s after R.v is evaluated in case it realloc's L.v.
> +                * eg: x = (v = "abc",  gsub("b", "X", v));
> +                */
> +               if ((opinfo & OF_RES1) && (opinfo & OF_STR1)) {
> +                       L.s = getvar_s(L.v);
> +                       debug_printf_eval("L.s:'%s'\n", L.s);
> +               }
> +
>                 debug_printf_eval("switch(0x%x)\n", XC(opinfo & OPCLSMASK));
>                 switch (XC(opinfo & OPCLSMASK)) {
>
> --
> 2.45.1
>
> _______________________________________________
> busybox mailing list
> busybox at busybox.net
> http://lists.busybox.net/mailman/listinfo/busybox