From fb08d43d44d1fea1f741fafb9aa7e1958a5f69aa Mon Sep 17 00:00:00 2001 From: Natanael Copa Date: Mon, 20 May 2024 17:55:28 +0200 Subject: [PATCH] awk: fix use after free (CVE-2023-42363) function old new delta evaluate 3377 3385 +8 Fixes https://bugs.busybox.net/show_bug.cgi?id=15865 Signed-off-by: Natanael Copa Signed-off-by: Denys Vlasenko CVE: CVE-2023-42363 Upstream-Status: Backport [https://git.busybox.net/busybox/commit/?id=fb08d43d44d1fea1f741fafb9aa7e1958a5f69aa] Signed-off-by: Peter Marko --- editors/awk.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/editors/awk.c b/editors/awk.c index 0981c6735..ff6d6350b 100644 --- a/editors/awk.c +++ b/editors/awk.c @@ -2910,19 +2910,14 @@ static var *evaluate(node *op, var *res) /* yes, remember where Fields[] is */ old_Fields_ptr = Fields; } - if (opinfo & OF_STR1) { - L.s = getvar_s(L.v); - debug_printf_eval("L.s:'%s'\n", L.s); - } if (opinfo & OF_NUM1) { L_d = getvar_i(L.v); debug_printf_eval("L_d:%f\n", L_d); } } - /* NB: Must get string/numeric values of L (done above) - * _before_ evaluate()'ing R.v: if both L and R are $NNNs, - * and right one is large, then L.v points to Fields[NNN1], - * second evaluate() reallocates and moves (!) Fields[], + /* NB: if both L and R are $NNNs, and right one is large, + * then at this pint L.v points to Fields[NNN1], second + * evaluate() below reallocates and moves (!) Fields[], * R.v points to Fields[NNN2] but L.v now points to freed mem! * (Seen trying to evaluate "$444 $44444") */ @@ -2942,6 +2937,16 @@ static var *evaluate(node *op, var *res) debug_printf_eval("R.s:'%s'\n", R.s); } } + /* Get L.s _after_ R.v is evaluated: it may have realloc'd L.v + * so we must get the string after "old_Fields_ptr" correction + * above. Testcase: x = (v = "abc", gsub("b", "X", v)); + */ + if (opinfo & OF_RES1) { + if (opinfo & OF_STR1) { + L.s = getvar_s(L.v); + debug_printf_eval("L.s:'%s'\n", L.s); + } + } debug_printf_eval("switch(0x%x)\n", XC(opinfo & OPCLSMASK)); switch (XC(opinfo & OPCLSMASK)) { -- 2.30.2