Bug 11516 - Awk segfault if NF is negative
Summary: Awk segfault if NF is negative
Status: RESOLVED FIXED
Alias: None
Product: Busybox
Classification: Unclassified
Component: Other (show other bugs)
Version: 1.28.x
Hardware: All Linux
: P5 normal
Target Milestone: ---
Assignee: unassigned
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-11-19 22:14 UTC by Luiz Angelo Daros de Luca
Modified: 2018-11-28 11:16 UTC (History)
1 user (show)

See Also:
Host:
Target:
Build:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Luiz Angelo Daros de Luca 2018-11-19 22:14:37 UTC 
Using busybox 1.28.3,

  echo 1 2 3 | awk 'BEGIN { NF-- }'
  echo | awk '{ NF-- }'

Will segfault awk. Whenever NF becomes negative, awk crashes.
Comment 1 Ron Yorston 2018-11-21 16:08:53 UTC 
In the same situation GNU awk terminates with the message:

   awk: cmd. line:1: (FILENAME=- FNR=1) fatal: NF set to negative value

We could to something similar by adding a couple of lines to the function handle_special in editors/awk.c:

    if (v == intvar[NF]) {
        n = (int)getvar_i(v);
+       if (n < 0)
+           syntax_error("NF set to negative value");
        fsrealloc(n);
Comment 2 Denys Vlasenko 2018-11-28 11:16:59 UTC 
Fixed in git, thanks!