[PATCH] awk: fix use after free (CVE-2023-42363)

[Natanael Copa]

Fixes https://bugs.busybox.net/show_bug.cgi?id=15865

Signed-off-by: Natanael Copa <ncopa at alpinelinux.org>
---
 editors/awk.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/editors/awk.c b/editors/awk.c
index 0981c6735..122376935 100644
--- a/editors/awk.c
+++ b/editors/awk.c
@@ -2981,10 +2981,6 @@ static var *evaluate(node *op, var *res)
 				/* yes, remember where Fields[] is */
 				old_Fields_ptr = Fields;
 			}
-			if (opinfo & OF_STR1) {
-				L.s = getvar_s(L.v);
-				debug_printf_eval("L.s:'%s'\n", L.s);
-			}
 			if (opinfo & OF_NUM1) {
 				L_d = getvar_i(L.v);
 				debug_printf_eval("L_d:%f\n", L_d);
@@ -3014,6 +3010,14 @@ static var *evaluate(node *op, var *res)
 			}
 		}
 
+		/* Must get L.s after R.v is evaluated in case it realloc's L.v.
+		 * eg: x = (v = "abc",  gsub("b", "X", v));
+		 */
+		if ((opinfo & OF_RES1) && (opinfo & OF_STR1)) {
+			L.s = getvar_s(L.v);
+			debug_printf_eval("L.s:'%s'\n", L.s);
+		}
+
 		debug_printf_eval("switch(0x%x)\n", XC(opinfo & OPCLSMASK));
 		switch (XC(opinfo & OPCLSMASK)) {
 
-- 
2.45.1