[prev in list] [next in list] [prev in thread] [next in thread]
List: busybox
Subject: [PATCH] awk.c: fix CVE-2023-42366 (bug #15874)
From: "Allen, Brett" <Brett.Allen () pega ! com>
Date: 2024-03-05 0:17:40
Message-ID: SA1PR13MB491221DBC51F81ADD444BF0F97222 () SA1PR13MB4912 ! namprd13 ! prod ! outlook ! com
[Download RAW message or body]
Hi All – I noticed the patch below was submitted to Bugzilla but I didn’t see it get \
posted to this list. I was checking for a fix to CVE-2023-42366 so wanted to ensure \
it wasn’t overlooked.
From 5cf8b332429a1dd9afef3337bae92aeddaeff993 Mon Sep 17 00:00:00 2001
From: Valery Ushakov uwe@stderr.spb.ru<mailto:uwe@stderr.spb.ru>
Date: Wed, 24 Jan 2024 22:24:41 +0300
Subject: [PATCH] awk.c: fix CVE-2023-42366 (bug #15874)
Make sure we don't read past the end of the string in next_token()
when backslash is the last character in an (invalid) regexp.
---
editors/awk.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/editors/awk.c b/editors/awk.c
index 728ee8685..be48df7c7 100644
--- a/editors/awk.c
+++ b/editors/awk.c
@@ -1165,9 +1165,11 @@ static uint32_t next_token(uint32_t expected)
s[-1] \
= bb_process_escape_sequence((const char **)&pp);
if (*p \
== '\\')
\
*s++ = '\\';
- if (pp \
== p) + \
if (pp == p) { + \
if (*p == '\0') + \
syntax_error(EMSG_UNEXP_EOS);
\
*s++ = *p++;
- else
+ } else
\
p = pp; }
}
--
2.34.1
[Attachment #3 (text/html)]
<html xmlns:v="urn:schemas-microsoft-com:vml" \
xmlns:o="urn:schemas-microsoft-com:office:office" \
xmlns:w="urn:schemas-microsoft-com:office:word" \
xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" \
xmlns="http://www.w3.org/TR/REC-html40"> <head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Aptos;
panose-1:2 11 0 4 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Aptos",sans-serif;
mso-ligatures:standardcontextual;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#467886;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:11.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#467886" vlink="#96607D" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Hi All – I noticed the patch below was submitted to Bugzilla but \
I didn’t see it get posted to this list. I was checking for a fix to \
CVE-2023-42366 so wanted to ensure it wasn’t overlooked.<o:p></o:p></p> <p \
class="MsoNormal"><o:p> </o:p></p> <p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">From 5cf8b332429a1dd9afef3337bae92aeddaeff993 Mon Sep 17 \
00:00:00 2001<o:p></o:p></p> <p class="MsoNormal">From: Valery Ushakov <a \
href="mailto:uwe@stderr.spb.ru">uwe@stderr.spb.ru</a><o:p></o:p></p> <p \
class="MsoNormal">Date: Wed, 24 Jan 2024 22:24:41 +0300<o:p></o:p></p> <p \
class="MsoNormal">Subject: [PATCH] awk.c: fix CVE-2023-42366 (bug \
#15874)<o:p></o:p></p> <p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Make sure we don't read past the end of the string in \
next_token()<o:p></o:p></p> <p class="MsoNormal">when backslash is the last character \
in an (invalid) regexp.<o:p></o:p></p> <p class="MsoNormal">---<o:p></o:p></p>
<p class="MsoNormal">editors/awk.c | 6 ++++--<o:p></o:p></p>
<p class="MsoNormal">1 file changed, 4 insertions(+), 2 deletions(-)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">diff --git a/editors/awk.c b/editors/awk.c<o:p></o:p></p>
<p class="MsoNormal">index 728ee8685..be48df7c7 100644<o:p></o:p></p>
<p class="MsoNormal">--- a/editors/awk.c<o:p></o:p></p>
<p class="MsoNormal">+++ b/editors/awk.c<o:p></o:p></p>
<p class="MsoNormal">@@ -1165,9 +1165,11 @@ static uint32_t next_token(uint32_t \
expected)<o:p></o:p></p> <p \
class="MsoNormal"> &n \
bsp; &nbs \
p; \
&n \
bsp; \
s[-1] = bb_process_escape_sequence((const char **)&pp);<o:p></o:p></p> <p \
class="MsoNormal"> &n \
bsp; &nbs \
p; \
&n \
bsp; \
if (*p == '\\')<o:p></o:p></p> <p \
class="MsoNormal"> &n \
bsp; &nbs \
p; \
&n \
bsp; &nbs \
p; \
*s++ = '\\';<o:p></o:p></p> <p \
class="MsoNormal">- & \
nbsp; &nb \
sp;   \
; & \
nbsp; \
if (pp == p)<o:p></o:p></p> <p \
class="MsoNormal">+ & \
nbsp; &nb \
sp;   \
; & \
nbsp; \
if (pp == p) {<o:p></o:p></p> <p \
class="MsoNormal">+ & \
nbsp; &nb \
sp;   \
; & \
nbsp; &nb \
sp; \
if (*p == '\0')<o:p></o:p></p> <p \
class="MsoNormal">+ & \
nbsp; &nb \
sp;   \
; & \
nbsp; &nb \
sp;   \
; \
syntax_error(EMSG_UNEXP_EOS);<o:p></o:p></p> <p \
class="MsoNormal"> &n \
bsp; &nbs \
p; \
&n \
bsp; &nbs \
p; \
*s++ = *p++;<o:p></o:p></p> <p \
class="MsoNormal">- & \
nbsp; &nb \
sp;   \
; & \
nbsp; \
else<o:p></o:p></p> <p \
class="MsoNormal">+ & \
nbsp; &nb \
sp;   \
; & \
nbsp; \
} else<o:p></o:p></p> <p \
class="MsoNormal"> &n \
bsp; &nbs \
p; \
&n \
bsp; &nbs \
p; \
p = pp;<o:p></o:p></p> <p \
class="MsoNormal"> &n \
bsp; &nbs \
p; \
\
}<o:p></o:p></p> <p class="MsoNormal"> \
&n \
bsp; \
}<o:p></o:p></p> <p class="MsoNormal">-- <o:p></o:p></p>
<p class="MsoNormal">2.34.1<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>
_______________________________________________
busybox mailing list
busybox@busybox.net
http://lists.busybox.net/mailman/listinfo/busybox
--===============7851980812994064829==--
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic