awk: fix use after free (CVE-2023-42363)

function                                             old     new   delta
evaluate                                            3377    3385      +8

Fixes https://bugs.busybox.net/show_bug.cgi?id=15865

Signed-off-by: Natanael Copa <ncopa@alpinelinux.org>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>

1 files changed, 13 insertions, 8 deletions

diff --git a/editors/awk.c b/editors/awk.c
index 0981c6735..ff6d6350b 100644
--- a/editors/awk.c
+++ b/editors/awk.c
@@ -2981,19 +2981,14 @@ static var *evaluate(node *op, var *res)
                                 /* yes, remember where Fields[] is */
                                 old_Fields_ptr = Fields;
                         }
-                        if (opinfo & OF_STR1) {
-                                L.s = getvar_s(L.v);
-                                debug_printf_eval("L.s:'%s'\n", L.s);
-                        }
                         if (opinfo & OF_NUM1) {
                                 L_d = getvar_i(L.v);
                                 debug_printf_eval("L_d:%f\n", L_d);
                         }
                 }
-                /* NB: Must get string/numeric values of L (done above)
-                 * _before_ evaluate()'ing R.v: if both L and R are $NNNs,
-                 * and right one is large, then L.v points to Fields[NNN1],
-                 * second evaluate() reallocates and moves (!) Fields[],
+                /* NB: if both L and R are $NNNs, and right one is large,
+                 * then at this pint L.v points to Fields[NNN1], second
+                 * evaluate() below reallocates and moves (!) Fields[],
                  * R.v points to Fields[NNN2] but L.v now points to freed mem!
                  * (Seen trying to evaluate "$444 $44444")
                  */
@@ -3013,6 +3008,16 @@ static var *evaluate(node *op, var *res)
                                 debug_printf_eval("R.s:'%s'\n", R.s);
                         }
                 }
+                /* Get L.s _after_ R.v is evaluated: it may have realloc'd L.v
+                 * so we must get the string after "old_Fields_ptr" correction
+                 * above. Testcase: x = (v = "abc", gsub("b", "X", v));
+                 */
+                if (opinfo & OF_RES1) {
+                        if (opinfo & OF_STR1) {
+                                L.s = getvar_s(L.v);
+                                debug_printf_eval("L.s:'%s'\n", L.s);
+                        }
+                }
 
                 debug_printf_eval("switch(0x%x)\n", XC(opinfo & OPCLSMASK));
                 switch (XC(opinfo & OPCLSMASK)) {