[PATCH] awk.c: fix CVE-2023-42366 (bug #15874)

[Allen, Brett]

Hi All – I noticed the patch below was submitted to Bugzilla but I didn’t see it get posted to this list.  I was checking for a fix to CVE-2023-42366 so wanted to ensure it wasn’t overlooked.


>From 5cf8b332429a1dd9afef3337bae92aeddaeff993 Mon Sep 17 00:00:00 2001
From: Valery Ushakov uwe at stderr.spb.ru<mailto:uwe at stderr.spb.ru>
Date: Wed, 24 Jan 2024 22:24:41 +0300
Subject: [PATCH] awk.c: fix CVE-2023-42366 (bug #15874)

Make sure we don't read past the end of the string in next_token()
when backslash is the last character in an (invalid) regexp.
---
editors/awk.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/editors/awk.c b/editors/awk.c
index 728ee8685..be48df7c7 100644
--- a/editors/awk.c
+++ b/editors/awk.c
@@ -1165,9 +1165,11 @@ static uint32_t next_token(uint32_t expected)
                                                                               s[-1] = bb_process_escape_sequence((const char **)&pp);
                                                                               if (*p == '\\')
                                                                                               *s++ = '\\';
-                                                                              if (pp == p)
+                                                                             if (pp == p) {
+                                                                                             if (*p == '\0')
+                                                                                                             syntax_error(EMSG_UNEXP_EOS);
                                                                                               *s++ = *p++;
-                                                                              else
+                                                                             } else
                                                                                               p = pp;
                                                               }
                                               }
--
2.34.1

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.busybox.net/pipermail/busybox/attachments/20240305/71cff6d5/attachment-0001.html>