BusyBox
/
busybox
mirror of https://github.com/mirror/busybox.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

awk: fix use after free (CVE-2023-42363) 

function                                             old     new   delta
evaluate                                            3377    3385      +8

Fixes https://bugs.busybox.net/show_bug.cgi?id=15865

Signed-off-by: Natanael Copa <ncopa@alpinelinux.org>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
master
Natanael Copa 2024-05-20 17:55:28 +02:00 committed by Denys Vlasenko
parent eba9b33b45
commit fb08d43d44
1 changed files with 13 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
editors/awk.c
View File

@ -2981,19 +2981,14 @@ static var *evaluate(node *op, var *res)
/* yes, remember where Fields[] is */
old_Fields_ptr = Fields;
}
if (opinfo & OF_STR1) {
L.s = getvar_s(L.v);
debug_printf_eval("L.s:'%s'\n", L.s);
}
if (opinfo & OF_NUM1) {
L_d = getvar_i(L.v);
debug_printf_eval("L_d:%f\n", L_d);
}
}
/* NB: Must get string/numeric values of L (done above)
* _before_ evaluate()'ing R.v: if both L and R are $NNNs,
* and right one is large, then L.v points to Fields[NNN1],
* second evaluate() reallocates and moves (!) Fields[],
/* NB: if both L and R are $NNNs, and right one is large,
* then at this pint L.v points to Fields[NNN1], second
* evaluate() below reallocates and moves (!) Fields[],
* R.v points to Fields[NNN2] but L.v now points to freed mem!
* (Seen trying to evaluate "$444 $44444")
*/
@ -3013,6 +3008,16 @@ static var *evaluate(node *op, var *res)
debug_printf_eval("R.s:'%s'\n", R.s);
}
}
/* Get L.s _after_ R.v is evaluated: it may have realloc'd L.v
* so we must get the string after "old_Fields_ptr" correction
* above. Testcase: x = (v = "abc", gsub("b", "X", v));
*/
if (opinfo & OF_RES1) {
if (opinfo & OF_STR1) {
L.s = getvar_s(L.v);
debug_printf_eval("L.s:'%s'\n", L.s);
}
}
debug_printf_eval("switch(0x%x)\n", XC(opinfo & OPCLSMASK));
switch (XC(opinfo & OPCLSMASK)) {