heap out of bound read in builtin.c Signed-off-by: Meenali Gupta <meenali.gu...@windriver.com> --- .../gawk/gawk/CVE-2023-4156.patch | 46 +++++++++++++++++++ meta/recipes-extended/gawk/gawk_5.1.1.bb | 1 + 2 files changed, 47 insertions(+) create mode 100644 meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch
diff --git a/meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch b/meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch new file mode 100644 index 0000000000..7becfa1dd7 --- /dev/null +++ b/meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch @@ -0,0 +1,46 @@ +From 75a02992e0049868d077fda26b32699465de54fc Mon Sep 17 00:00:00 2001 +From: Arnold D. Robbins <arn...@skeeve.com> +Date: Wed, 3 Aug 2022 15:30:54 +0530 +Subject: [PATCH] gawk: Small bug fix in builtin.c + +Upstream-Status: Backport [https://git.savannah.gnu.org/gitweb/?p=gawk.git;a=commitdiff;h=e709eb829448ce040087a3fc5481db6bfcaae212] +CVE: CVE-2023-4156 + +Signed-off-by: Meenali Gupta <meenali.gu...@windriver.com> +--- + ChangeLog | 6 ++++++ + builtin.c | 5 ++++- + 2 files changed, 10 insertions(+), 1 deletion(-) + +diff --git a/ChangeLog b/ChangeLog +index 6b51464..39a5a7f 100644 +--- a/ChangeLog ++++ b/ChangeLog +@@ -1,3 +1,9 @@ ++2022-08-03 Arnold D. Robbins <arn...@skeeve.com> ++ ++ * builtin.c (format_tree): When collecting positional field widths or ++ precisions, check for wrap around to negative values. Thanks to ++ YU Jiongchi <jcyu.2...@phdcs.smu.edu.sg> for the report. ++ + 2021-10-27 Arnold D. Robbins <arn...@skeeve.com> + + * 5.1.1: Release tar ball made. +diff --git a/builtin.c b/builtin.c +index d7ba82c..4ee3f3f 100644 +--- a/builtin.c ++++ b/builtin.c +@@ -963,7 +963,10 @@ check_pos: + s1++; + n0--; + } +- if (val >= num_args) { ++ // val could be less than zero if someone provides a field width ++ // so large that it causes integer overflow. Mainly fuzzers do this, ++ // but let's try to be good anyway. ++ if (val < 0 || val >= num_args) { + toofew = true; + break; + } +-- +2.40.0 diff --git a/meta/recipes-extended/gawk/gawk_5.1.1.bb b/meta/recipes-extended/gawk/gawk_5.1.1.bb index fe339805d0..ecc8ca3bd2 100644 --- a/meta/recipes-extended/gawk/gawk_5.1.1.bb +++ b/meta/recipes-extended/gawk/gawk_5.1.1.bb @@ -18,6 +18,7 @@ PACKAGECONFIG[mpfr] = "--with-mpfr,--without-mpfr, mpfr" SRC_URI = "${GNU_MIRROR}/gawk/gawk-${PV}.tar.gz \ file://remove-sensitive-tests.patch \ file://run-ptest \ + file://CVE-2023-4156.patch \ " SRC_URI[sha256sum] = "6168d8d1dc8f74bd17d9dc22fa9634c49070f232343b744901da15fb4f06bffd" -- 2.40.0
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#187004): https://lists.openembedded.org/g/openembedded-core/message/187004 Mute This Topic: https://lists.openembedded.org/mt/101092729/21656 Group Owner: openembedded-core+ow...@lists.openembedded.org Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
