Fix CVE-2026-40468: integer overflow in do_sub() and parse_escape()
Backport fix for CVE-2026-40468 to gawk 4.2.1. The new patch (gawk-4.2.1-CVE-2026-40468.patch) is based on two upstream commits (062f2f25, aa7272a6) that fix integer overflow issues in do_sub() (builtin.c) and parse_escape() (node.c). The fix changes variable types to prevent overflow and adds explicit 64-bit overflow bounds checking before realloc in do_sub(), providing a fatal error message instead of heap corruption. CVE: CVE-2026-40468 Upstream patches: -062f2f2581.patch -aa7272a6e1.patch Resolves: RHEL-222771 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent
parent
292305e094
commit
90b3b4eff9
96
gawk-4.2.1-CVE-2026-40468.patch
Normal file
96
gawk-4.2.1-CVE-2026-40468.patch
Normal file
@ -0,0 +1,96 @@
|
||||
From 36b7ed9b3b352c3719e8430081f6b0469ca70385 Mon Sep 17 00:00:00 2001
|
||||
From: "Arnold D. Robbins" <arnold@skeeve.com>
|
||||
Date: Sat, 4 Apr 2026 21:45:58 +0300
|
||||
Subject: [PATCH 1/2] Minor integer overflow fixes.
|
||||
|
||||
---
|
||||
builtin.c | 2 +-
|
||||
node.c | 2 +-
|
||||
2 files changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/builtin.c b/builtin.c
|
||||
index 6927205c..b3f652f2 100644
|
||||
--- a/builtin.c
|
||||
+++ b/builtin.c
|
||||
@@ -2879,7 +2879,7 @@ do_sub(int nargs, unsigned int flags)
|
||||
char *repl;
|
||||
char *replend;
|
||||
size_t repllen;
|
||||
- int sofar;
|
||||
+ size_t sofar;
|
||||
int ampersands;
|
||||
int matches = 0;
|
||||
Regexp *rp;
|
||||
diff --git a/node.c b/node.c
|
||||
index add959f7..d792429b 100644
|
||||
--- a/node.c
|
||||
+++ b/node.c
|
||||
@@ -519,7 +519,7 @@ int
|
||||
parse_escape(const char **string_ptr)
|
||||
{
|
||||
int c = *(*string_ptr)++;
|
||||
- int i;
|
||||
+ int64_t i;
|
||||
int count;
|
||||
int j;
|
||||
const char *start;
|
||||
|
||||
From ba456e26f555123752b3a61537049548403cc726 Mon Sep 17 00:00:00 2001
|
||||
From: "Arnold D. Robbins" <arnold@skeeve.com>
|
||||
Date: Mon, 6 Apr 2026 10:56:38 +0300
|
||||
Subject: [PATCH 2/2] Add overflow checking in do_sub for 32 bit systems.
|
||||
|
||||
---
|
||||
builtin.c | 20 ++++++++++++++++++++
|
||||
1 file changed, 20 insertions(+)
|
||||
|
||||
diff --git a/builtin.c b/builtin.c
|
||||
index b3f652f2..c2c1cda1 100644
|
||||
--- a/builtin.c
|
||||
+++ b/builtin.c
|
||||
@@ -2892,11 +2892,14 @@ do_sub(int nargs, unsigned int flags)
|
||||
long current;
|
||||
bool lastmatchnonzero;
|
||||
char *mb_indices = NULL;
|
||||
+ const char *fname = NULL; // for fatal message, below
|
||||
|
||||
if ((flags & GENSUB) != 0) {
|
||||
double d;
|
||||
NODE *glob_flag;
|
||||
|
||||
+ fname = "gensub";
|
||||
+
|
||||
tmp = PEEK(3);
|
||||
rp = re_update(tmp);
|
||||
|
||||
@@ -2925,6 +2928,8 @@ do_sub(int nargs, unsigned int flags)
|
||||
}
|
||||
DEREF(glob_flag);
|
||||
} else {
|
||||
+ fname = ((flags & GSUB) != 0) ? "gsub" : "sub";
|
||||
+
|
||||
/* take care of regexp early, in case re_update is fatal */
|
||||
|
||||
tmp = PEEK(2);
|
||||
@@ -3041,6 +3046,21 @@ do_sub(int nargs, unsigned int flags)
|
||||
* vary since ampersand is actual text of regexp match.
|
||||
*/
|
||||
|
||||
+ // 4/2026: This overflow check simply provides a fatal
|
||||
+ // message instead of letting realloc() die later after
|
||||
+ // a buffer overrun. It simply makes the user experience better,
|
||||
+ // but does not prevent gawk from dying miserably. I suppose
|
||||
+ // it's worth the trouble, but just barely.
|
||||
+
|
||||
+ /* uint64_t so the product is 64-bit even on 32-bit ILP32 builds */
|
||||
+ uint64_t repl_contribution =
|
||||
+ (uint64_t)(unsigned int)ampersands
|
||||
+ * (uint64_t)(uintptr_t)(matchend - matchstart);
|
||||
+ if (repl_contribution > (uint64_t)SIZE_MAX
|
||||
+ || repl_contribution > (uint64_t)SIZE_MAX - (size_t)(matchend - text)
|
||||
+ - repllen - 1)
|
||||
+ fatal(_("%s: replacement expansion too large"), fname);
|
||||
+
|
||||
/*
|
||||
* add 1 to len to handle "empty" case where
|
||||
* matchend == matchstart and we force a match on a single
|
||||
10
gawk.spec
10
gawk.spec
@ -44,7 +44,7 @@
|
||||
Name: gawk
|
||||
Summary: The GNU version of the AWK text processing utility
|
||||
Version: 4.2.1
|
||||
Release: 4%{?dist}
|
||||
Release: 4%{?dist}.1
|
||||
|
||||
License: GPLv3+ and GPLv2+ and LGPLv2+ and BSD
|
||||
|
||||
@ -107,6 +107,10 @@ BuildRequires: bison
|
||||
Patch000: assign-int.patch
|
||||
Patch001: proc-rv.patch
|
||||
|
||||
# https://github.com/sysfce2/gawk/commit/062f2f2581b991362c046f7f2e238ffa34e6f8c7
|
||||
# https://github.com/sysfce2/gawk/commit/aa7272a6e1184cdd21ab8f89200219abd8053eda
|
||||
Patch002: gawk-4.2.1-CVE-2026-40468.patch
|
||||
|
||||
# Downstream patches -- these should be always included when doing rebase:
|
||||
# ------------------
|
||||
#Patch100: example100.patch
|
||||
@ -257,6 +261,10 @@ install -m 0644 -p doc/gawkinet.{pdf,ps} %{buildroot}%{_docdir}/%{name}
|
||||
# =============================================================================
|
||||
|
||||
%changelog
|
||||
* Mon Aug 03 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 4.2.1-4.1
|
||||
- Fix integer overflow in do_sub() and parse_escape() (CVE-2026-40468)
|
||||
Resolves: RHEL-222771
|
||||
|
||||
* Fri Feb 11 2022 Jakub Martisko <jamartis@redhat.com> - 4.2.1-4
|
||||
- Rebuild with some gating tests disabled
|
||||
Resolves: rhbz#2053515
|
||||
|
||||
Loading…
Reference in New Issue
Block a user