Hi tech@,

Here is a diff to fix a segmentation fault in awk, from upstream
version 20121220 [1]. Upstream fix didn't check for strdup return value
so I added the check.

I've been seeing some awk.core files in my home directory for a while
now, and finally decided to try investigating why it happened. It turns
out misc/mc calls awk to process file information when navigating through
ZIP files, and it sometimes causes awk to segfault.

[1] http://distcache.FreeBSD.org/ports-distfiles/nawk-20121220/awk.tar.gz

Comments? OK?

Index: usr.bin/awk/run.c
===================================================================
RCS file: /cvs/src/usr.bin/awk/run.c,v
retrieving revision 1.42
diff -u -p -r1.42 run.c
--- usr.bin/awk/run.c   9 Oct 2017 14:51:31 -0000       1.42
+++ usr.bin/awk/run.c   12 Aug 2019 18:01:14 -0000
@@ -1217,13 +1217,15 @@ Cell *dopa2(Node **a, int n)    /* a[0], a[
 Cell *split(Node **a, int nnn) /* split(a[0], a[1], a[2]); a[3] is type */
 {
        Cell *x = 0, *y, *ap;
-       char *s;
+       char *s, *origs;
        int sep;
        char *t, temp, num[50], *fs = 0;
        int n, tempstat, arg3type;
 
        y = execute(a[0]);      /* source string */
-       s = getsval(y);
+       origs = s = strdup(getsval(y));
+       if (s == NULL)
+               FATAL("out of space in split");
        arg3type = ptoi(a[3]);
        if (a[2] == 0)          /* fs string */
                fs = *FS;
@@ -1343,6 +1345,7 @@ Cell *split(Node **a, int nnn)    /* split(
        }
        tempfree(ap);
        tempfree(y);
+       free(origs);
        if (a[2] != 0 && arg3type == STRING) {
                tempfree(x);
        }

Reply via email to