1 files changed, 20 insertions, 6 deletions

diff --git a/editors/awk.c b/editors/awk.c
index 728ee8685..2af823808 100644
--- a/editors/awk.c
+++ b/editors/awk.c
@@ -555,7 +555,7 @@ struct globals {
         const char *g_progname;
         int g_lineno;
         int nfields;
-        int maxfields; /* used in fsrealloc() only */
+        unsigned maxfields;
         var *Fields;
         char *g_pos;
         char g_saved_ch;
@@ -1931,9 +1931,9 @@ static void fsrealloc(int size)
 {
         int i, newsize;
 
-        if (size >= maxfields) {
-                /* Sanity cap, easier than catering for overflows */
-                if (size > 0xffffff)
+        if ((unsigned)size >= maxfields) {
+                /* Sanity cap, easier than catering for over/underflows */
+                if ((unsigned)size > 0xffffff)
                         bb_die_memory_exhausted();
 
                 i = maxfields;
@@ -2891,6 +2891,7 @@ static var *evaluate(node *op, var *res)
                 uint32_t opinfo;
                 int opn;
                 node *op1;
+                var *old_Fields_ptr;
 
                 opinfo = op->info;
                 opn = (opinfo & OPNMASK);
@@ -2899,10 +2900,16 @@ static var *evaluate(node *op, var *res)
                 debug_printf_eval("opinfo:%08x opn:%08x\n", opinfo, opn);
 
                 /* execute inevitable things */
+                old_Fields_ptr = NULL;
                 if (opinfo & OF_RES1) {
                         if ((opinfo & OF_REQUIRED) && !op1)
                                 syntax_error(EMSG_TOO_FEW_ARGS);
                         L.v = evaluate(op1, TMPVAR0);
+                        /* Does L.v point to $n variable? */
+                        if ((size_t)(L.v - Fields) < maxfields) {
+                                /* yes, remember where Fields[] is */
+                                old_Fields_ptr = Fields;
+                        }
                         if (opinfo & OF_STR1) {
                                 L.s = getvar_s(L.v);
                                 debug_printf_eval("L.s:'%s'\n", L.s);
@@ -2921,8 +2928,15 @@ static var *evaluate(node *op, var *res)
                  */
                 if (opinfo & OF_RES2) {
                         R.v = evaluate(op->r.n, TMPVAR1);
-                        //TODO: L.v may be invalid now, set L.v to NULL to catch bugs?
-                        //L.v = NULL;
+                        /* Seen in $5=$$5=$0:
+                         * Evaluation of R.v ($$5=$0 expression)
+                         * made L.v ($5) invalid. It's detected here.
+                         */
+                        if (old_Fields_ptr) {
+                                //if (old_Fields_ptr != Fields)
+                                //      debug_printf_eval("L.v moved\n");
+                                L.v += Fields - old_Fields_ptr;
+                        }
                         if (opinfo & OF_STR2) {
                                 R.s = getvar_s(R.v);
                                 debug_printf_eval("R.s:'%s'\n", R.s);