rpms/gawk
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2026-40467: use-after-free in do_getline_redir()

Browse Source 
Backport upstream fix (commit a2d18c74) for CVE-2026-40467,
a use-after-free vulnerability in io.c's do_getline_redir()
function. The fix moves the DEREF(redir_exp) call from one
early site to four separate locations right before each
return/fatal path, preventing the node from being freed
before it is still needed by is_non_fatal_redirect().

CVE: CVE-2026-40467
Upstream patches:
 - https://cgit.git.savannah.gnu.org/cgit/gawk.git/patch/?id=a2d18c74109e41bec29a23098eba2e00057286d8
Resolves: RHEL-222601

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent 2026-09-04 08:43:30 +00:00
parent 90b3b4eff9
commit 8226b4922e
2 changed files with 49 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
gawk-4.2.1-CVE-2026-40467.patch Normal file
View File

@ -0,0 +1,40 @@
From 06ab08ad83f62b61cc8277bb16d3e51c7f0ee123 Mon Sep 17 00:00:00 2001
From: "Arnold D. Robbins" <arnold@skeeve.com>
Date: Fri, 3 Apr 2026 12:02:11 +0300
Subject: [PATCH] Small memory management fix in io.c.
---
io.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/io.c b/io.c
index 33eacf8..c03aaf6 100644
--- a/io.c
+++ b/io.c
@@ -2790,22 +2790,25 @@ do_getline_redir(int into_variable, enum redirval redirtype)
assert(redirtype != redirect_none);
redir_exp = TOP();
rp = redirect(redir_exp, redirtype, & redir_error, false);
- DEREF(redir_exp);
decr_sp();
if (rp == NULL) {
if (redir_error) { /* failed redirect */
if (! do_traditional)
update_ERRNO_int(redir_error);
}
+ DEREF(redir_exp);
return make_number((AWKNUM) -1.0);
} else if ((rp->flag & RED_TWOWAY) != 0 && rp->iop == NULL) {
if (is_non_fatal_redirect(redir_exp->stptr, redir_exp->stlen)) {
update_ERRNO_int(EBADF);
+ DEREF(redir_exp);
return make_number((AWKNUM) -1.0);
}
(void) close_rp(rp, CLOSE_ALL);
+ DEREF(redir_exp); // we're about to die, but what the heck, release it anyway
fatal(_("getline: attempt to read from closed read end of two-way pipe"));
}
+ DEREF(redir_exp);
iop = rp->iop;
if (iop == NULL) /* end of input */
return make_number((AWKNUM) 0.0);

10
gawk.spec
View File

@ -44,7 +44,7 @@
Name: gawk
Summary: The GNU version of the AWK text processing utility
Version: 4.2.1
Release: 4%{?dist}.1
Release: 5%{?dist}
License: GPLv3+ and GPLv2+ and LGPLv2+ and BSD
@ -111,6 +111,10 @@ Patch001: proc-rv.patch
# https://github.com/sysfce2/gawk/commit/aa7272a6e1184cdd21ab8f89200219abd8053eda
Patch002: gawk-4.2.1-CVE-2026-40468.patch
# https://issues.redhat.com/browse/RHEL-222601
# https://cgit.git.savannah.gnu.org/cgit/gawk.git/patch/?id=a2d18c74109e41bec29a23098eba2e00057286d8
Patch003: gawk-4.2.1-CVE-2026-40467.patch
# Downstream patches -- these should be always included when doing rebase:
# ------------------
#Patch100: example100.patch
@ -261,6 +265,10 @@ install -m 0644 -p doc/gawkinet.{pdf,ps} %{buildroot}%{_docdir}/%{name}
# =============================================================================
%changelog
* Fri Sep 04 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 4.2.1-5
- Fix use-after-free in do_getline_redir() (CVE-2026-40467)
Resolves: RHEL-222601
* Mon Aug 03 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 4.2.1-4.1
- Fix integer overflow in do_sub() and parse_escape() (CVE-2026-40468)
Resolves: RHEL-222771