Hello Adrian, Salvatore, On Tue, Jul 14, 2026 at 10:36:29PM +0200, Salvatore Bonaccorso wrote: > Source: gawk > Version: 1:5.3.2-1 > Severity: important > Tags: security upstream > X-Debbugs-Cc: [email protected], Debian Security Team > <[email protected]> > > Hi, > > The following vulnerabilities were published for gawk. [...]
I picked up the task of handling gawk for LTS Team. As the problem is unfixed in unstable/testing/stable/LTS/ELTS releases I'm offering my assistance to NMU and fix the issues in all releases. I'm attaching initial draft patches for backporting the relevant upstream commits against the unstable version. I've also prepared a draft bookworm (LTS) update and the backported patches are very similar there. The trixie version is the same as bookworm. I'm thus proposing we fix the issues in unstable/testing by backporting patches as that should give some partial confidence that they are correct for older releases, and postpone updating to then new upstream release that is available. (Once unstable/testing is done, I'm willing to take care of stable-proposed-update next.) I'm also tempted at taking care of some lintian warnings while at it, but maybe I should resist the urge. Please speak up if you'd like to proceed differently! Regards, Andreas Henriksson
>From b30ddf74e13d619482f787b8dc69c53cfd615fa2 Mon Sep 17 00:00:00 2001 From: Andreas Henriksson <[email protected]> Date: Sun, 6 Sep 2026 14:21:22 +0200 Subject: [PATCH 1/2] Cherry-pick/backport patches from upstream Fixes: CVE-2026-40467 CVE-2026-40468 CVE-2026-40469 CVE-2026-40553 Closes: #1142071 Gbp-Dch: Full --- debian/patches/CVE-2026-40467.patch | 40 ++++++++++++++++++ debian/patches/CVE-2026-40468.patch | 36 ++++++++++++++++ debian/patches/CVE-2026-40469.patch | 65 +++++++++++++++++++++++++++++ debian/patches/CVE-2026-40553.patch | 27 ++++++++++++ debian/patches/series | 4 ++ 5 files changed, 172 insertions(+) create mode 100644 debian/patches/CVE-2026-40467.patch create mode 100644 debian/patches/CVE-2026-40468.patch create mode 100644 debian/patches/CVE-2026-40469.patch create mode 100644 debian/patches/CVE-2026-40553.patch create mode 100644 debian/patches/series diff --git a/debian/patches/CVE-2026-40467.patch b/debian/patches/CVE-2026-40467.patch new file mode 100644 index 000000000..4eec6c329 --- /dev/null +++ b/debian/patches/CVE-2026-40467.patch @@ -0,0 +1,40 @@ +From: "Arnold D. Robbins" <[email protected]> +Date: Fri, 3 Apr 2026 12:02:11 +0300 +Subject: Small memory management fix in io.c. + +(cherry picked from commit a2d18c74109e41bec29a23098eba2e00057286d8) +--- + io.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/io.c b/io.c +index f1c962d..5f58efa 100644 +--- a/io.c ++++ b/io.c +@@ -2838,22 +2838,25 @@ do_getline_redir(int into_variable, enum redirval redirtype) + assert(redirtype != redirect_none); + redir_exp = TOP(); + rp = redirect(redir_exp, redirtype, & redir_error, false); +- DEREF(redir_exp); + decr_sp(); + if (rp == NULL) { + if (redir_error) { /* failed redirect */ + if (! do_traditional) + update_ERRNO_int(redir_error); + } ++ DEREF(redir_exp); + return make_number((AWKNUM) -1.0); + } else if ((rp->flag & RED_TWOWAY) != 0 && rp->iop == NULL) { + if (is_non_fatal_redirect(redir_exp->stptr, redir_exp->stlen)) { + update_ERRNO_int(EBADF); ++ DEREF(redir_exp); + return make_number((AWKNUM) -1.0); + } + (void) close_rp(rp, CLOSE_ALL); ++ DEREF(redir_exp); // we're about to die, but what the heck, release it anyway + fatal(_("getline: attempt to read from closed read end of two-way pipe")); + } ++ DEREF(redir_exp); + iop = rp->iop; + if (iop == NULL) /* end of input */ + return make_number((AWKNUM) 0.0); diff --git a/debian/patches/CVE-2026-40468.patch b/debian/patches/CVE-2026-40468.patch new file mode 100644 index 000000000..a738233cc --- /dev/null +++ b/debian/patches/CVE-2026-40468.patch @@ -0,0 +1,36 @@ +From: "Arnold D. Robbins" <[email protected]> +Date: Sat, 4 Apr 2026 21:45:58 +0300 +Subject: Minor integer overflow fixes. + +(cherry picked from commit 062f2f2581b991362c046f7f2e238ffa34e6f8c7) +--- + builtin.c | 2 +- + node.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/builtin.c b/builtin.c +index 1f4f46c..e204d93 100644 +--- a/builtin.c ++++ b/builtin.c +@@ -1809,7 +1809,7 @@ do_sub(int nargs, unsigned int flags) + char *repl; + char *replend; + size_t repllen; +- int sofar; ++ size_t sofar; + int ampersands; + int matches = 0; + Regexp *rp; +diff --git a/node.c b/node.c +index 975fcb1..e03cb2a 100644 +--- a/node.c ++++ b/node.c +@@ -584,7 +584,7 @@ parse_escape(const char **string_ptr, const char **result, size_t *nbytes) + static char buf[MB_LEN_MAX]; + enum escape_results retval = ESCAPE_OK; + int c = *(*string_ptr)++; +- int i; ++ int64_t i; + int count; + int j; + const char *start; diff --git a/debian/patches/CVE-2026-40469.patch b/debian/patches/CVE-2026-40469.patch new file mode 100644 index 000000000..98af54a30 --- /dev/null +++ b/debian/patches/CVE-2026-40469.patch @@ -0,0 +1,65 @@ +From: "Arnold D. Robbins" <[email protected]> +Date: Mon, 6 Apr 2026 10:56:38 +0300 +Subject: Add overflow checking in do_sub for 32 bit systems. + +Backported upstream commit ae1b2d508f46913269a9e62aceda3636afe8147b +Excluding support/minrx.c changes as that does not yet exist. +--- + builtin.c | 25 ++++++++++++++++++++----- + 1 file changed, 20 insertions(+), 5 deletions(-) + +diff --git a/builtin.c b/builtin.c +index e204d93..68d5eb7 100644 +--- a/builtin.c ++++ b/builtin.c +@@ -1822,11 +1822,13 @@ do_sub(int nargs, unsigned int flags) + long current; + bool lastmatchnonzero; + char *mb_indices = NULL; ++ const char *fname = NULL; // for fatal message, below + + if ((flags & GENSUB) != 0) { + double d; + NODE *glob_flag; + ++ fname = "gensub"; + check_exact_args(nargs, "gensub", 4); + + tmp = PEEK(3); +@@ -1857,11 +1859,9 @@ do_sub(int nargs, unsigned int flags) + } + DEREF(glob_flag); + } else { +- if ((flags & GSUB) != 0) { +- check_exact_args(nargs, "gsub", 3); +- } else { +- check_exact_args(nargs, "sub", 3); +- } ++ fname = ((flags & GSUB) != 0) ? "gsub" : "sub"; ++ ++ check_exact_args(nargs, fname, 3); + + /* take care of regexp early, in case re_update is fatal */ + +@@ -1977,6 +1977,21 @@ do_sub(int nargs, unsigned int flags) + * vary since ampersand is actual text of regexp match. + */ + ++ // 4/2026: This overflow check simply provides a fatal ++ // message instead of letting realloc() die later after ++ // a buffer overrun. It simply makes the user experience better, ++ // but does not prevent gawk from dying miserably. I suppose ++ // it's worth the trouble, but just barely. ++ ++ /* uint64_t so the product is 64-bit even on 32-bit ILP32 builds */ ++ uint64_t repl_contribution = ++ (uint64_t)(unsigned int)ampersands ++ * (uint64_t)(uintptr_t)(matchend - matchstart); ++ if (repl_contribution > (uint64_t)SIZE_MAX ++ || repl_contribution > (uint64_t)SIZE_MAX - (size_t)(matchend - text) ++ - repllen - 1) ++ fatal(_("%s: replacement expansion too large"), fname); ++ + /* + * add 1 to len to handle "empty" case where + * matchend == matchstart and we force a match on a single diff --git a/debian/patches/CVE-2026-40553.patch b/debian/patches/CVE-2026-40553.patch new file mode 100644 index 000000000..5cd07ab10 --- /dev/null +++ b/debian/patches/CVE-2026-40553.patch @@ -0,0 +1,27 @@ +From: "Arnold D. Robbins" <[email protected]> +Date: Wed, 15 Apr 2026 09:39:02 +0300 +Subject: Avoid buffer overflow in extension/readdir.c. + +(cherry picked from commit cca0366144336b49aaa7d5d949966ce8e2c70843) +--- + extension/readdir.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/extension/readdir.c b/extension/readdir.c +index 788e1d1..b525fe2 100644 +--- a/extension/readdir.c ++++ b/extension/readdir.c +@@ -117,8 +117,12 @@ ftype(struct dirent *entry, const char *dirname) + #endif + char fname[PATH_MAX]; + struct stat sbuf; ++ int count; ++ ++ count = snprintf(fname, sizeof(fname), "%s/%s", dirname, entry->d_name); ++ if (count > sizeof(fname)) ++ return "u"; // buffer overflow. skip stat() call. + +- sprintf(fname, "%s/%s", dirname, entry->d_name); + if (stat(fname, &sbuf) == 0) { + if (S_ISBLK(sbuf.st_mode)) + return "b"; diff --git a/debian/patches/series b/debian/patches/series new file mode 100644 index 000000000..727605fe3 --- /dev/null +++ b/debian/patches/series @@ -0,0 +1,4 @@ +CVE-2026-40467.patch +CVE-2026-40468.patch +CVE-2026-40469.patch +CVE-2026-40553.patch -- 2.47.3
>From cd641bd40fbd8a7b9fb6e2b4394ff77f45b18be6 Mon Sep 17 00:00:00 2001 From: Andreas Henriksson <[email protected]> Date: Sun, 6 Sep 2026 14:22:53 +0200 Subject: [PATCH 2/2] Update debian/changelog --- debian/changelog | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/debian/changelog b/debian/changelog index 233bda816..202022acc 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,12 @@ +gawk (1:5.3.2-1.1) unstable; urgency=medium + + * Non-maintainer upload by the LTS Team. + * Cherry-pick/backport patches from upstream. + Fixes: CVE-2026-40467 CVE-2026-40468 CVE-2026-40469 CVE-2026-40553 + (Closes: #1142071) + + -- Andreas Henriksson <[email protected]> Sun, 06 Sep 2026 14:22:07 +0200 + gawk (1:5.3.2-1) unstable; urgency=medium * New upstream release. (Closes: #1055548) -- 2.47.3
