gawk/CVE-2026-40467.patch
Jakub Martisko 9590e21a2c Fix CVEs 2026-40553, 2026-40467, CVE-2026-40468
Resolves: RHEL-223429
Resolves: RHEL-222590
Resolves: RHEL-222774
2026-08-24 09:29:11 +02:00

41 lines
1.3 KiB
Diff

From 7016e0e024012490356fb8ccff270d78e0eacf12 Mon Sep 17 00:00:00 2001
From: "Arnold D. Robbins" <arnold@skeeve.com>
Date: Fri, 3 Apr 2026 12:02:11 +0300
Subject: [PATCH] Small memory management fix in io.c.
---
io.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/io.c b/io.c
index c595c009..abae0373 100644
--- a/io.c
+++ b/io.c
@@ -2836,22 +2836,25 @@ do_getline_redir(int into_variable, enum redirval redirtype)
assert(redirtype != redirect_none);
redir_exp = TOP();
rp = redirect(redir_exp, redirtype, & redir_error, false);
- DEREF(redir_exp);
decr_sp();
if (rp == NULL) {
if (redir_error) { /* failed redirect */
if (! do_traditional)
update_ERRNO_int(redir_error);
}
+ DEREF(redir_exp);
return make_number((AWKNUM) -1.0);
} else if ((rp->flag & RED_TWOWAY) != 0 && rp->iop == NULL) {
if (is_non_fatal_redirect(redir_exp->stptr, redir_exp->stlen)) {
update_ERRNO_int(EBADF);
+ DEREF(redir_exp);
return make_number((AWKNUM) -1.0);
}
(void) close_rp(rp, CLOSE_ALL);
+ DEREF(redir_exp); // we're about to die, but what the heck, release it anyway
fatal(_("getline: attempt to read from closed read end of two-way pipe"));
}
+ DEREF(redir_exp);
iop = rp->iop;
if (iop == NULL) /* end of input */
return make_number((AWKNUM) 0.0);