Bug 11516

Summary: Awk segfault if NF is negative
Product: Busybox Reporter: Luiz Angelo Daros de Luca <luizluca>
Component: OtherAssignee: unassigned
Status: RESOLVED FIXED    
Severity: normal CC: busybox-cvs
Priority: P5    
Version: 1.28.x   
Target Milestone: ---   
Hardware: All   
OS: Linux   
Host: Target:
Build:

Description Luiz Angelo Daros de Luca 2018-11-19 22:14:37 UTC
Using busybox 1.28.3,

  echo 1 2 3 | awk 'BEGIN { NF-- }'
  echo | awk '{ NF-- }'

Will segfault awk. Whenever NF becomes negative, awk crashes.
Comment 1 Ron Yorston 2018-11-21 16:08:53 UTC
In the same situation GNU awk terminates with the message:

   awk: cmd. line:1: (FILENAME=- FNR=1) fatal: NF set to negative value

We could to something similar by adding a couple of lines to the function handle_special in editors/awk.c:

    if (v == intvar[NF]) {
        n = (int)getvar_i(v);
+       if (n < 0)
+           syntax_error("NF set to negative value");
        fsrealloc(n);
Comment 2 Denys Vlasenko 2018-11-28 11:16:59 UTC
Fixed in git, thanks!