gawk: Fix CVE-2026-40469

NVD [3] identifies upstream merge commit [2] as the fix. The CVE-specific change is its second parent [1], which adds 32-bit overflow checking in do_sub(). [1] https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=aa7272a6e1184cdd21ab8f89200219abd8053eda [2] https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=ae1b2d508f46913269a9e62aceda3636afe8147b [3] https://nvd.nist.gov/vuln/detail/CVE-2026-40469 (From OE-Core rev: 421a3d2166e922c5a8085be0aa9daab13920b613) Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com> Reviewed-by: Leonid Iziumtsev <leonid.iziumtsev@est.tech> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>
2026-08-31 02:23:22 +00:00 · 2026-07-31 16:41:22 +01:00
parent e84e827496
commit 5cd9ed667f
2 changed files with 91 additions and 0 deletions
@@ -0,0 +1,90 @@
+From f907980a3e7a58006b796308021c8410a24e0f3c Mon Sep 17 00:00:00 2001
+From: "Arnold D. Robbins" <arnold@skeeve.com>
+Date: Mon, 6 Apr 2026 10:56:38 +0300
+Subject: [PATCH] Add overflow checking in do_sub for 32 bit systems.
+
+CVE: CVE-2026-40469
+Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=aa7272a6e1184cdd21ab8f89200219abd8053eda]
+
+(cherry picked from commit aa7272a6e1184cdd21ab8f89200219abd8053eda)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ ChangeLog |  9 +++++++++
+ builtin.c | 25 ++++++++++++++++++++-----
+ 2 files changed, 29 insertions(+), 5 deletions(-)
+
+diff --git a/ChangeLog b/ChangeLog
+index e691b241..74eea81f 100644
+--- a/ChangeLog
+++ b/ChangeLog
+@@ -1,3 +1,12 @@
+2026-04-06         Arnold D. Robbins     <arnold@skeeve.com>
+
+	* builtin.c (do_sub): Check for overflow in calculation of size
+	of result buffer by doing the math in 64 bits. This provides
+	a fatal message on 32 bit systems if overflow happens instead
+	of letting dynamic memory get corrupted and likely causing
+	a core dump. Thanks to Michał Majchrowicz <mmajchrowicz@afine.com>
+	for the report and fix.
+
+ 2026-04-04         Arnold D. Robbins     <arnold@skeeve.com>
+ 
+ 	* builtin.c (do_sub): Make `sofar' be size_t to avoid
+diff --git a/builtin.c b/builtin.c
+index 80ab6069..d63cf47b 100644
+--- a/builtin.c
+++ b/builtin.c
+@@ -2998,11 +2998,13 @@ do_sub(int nargs, unsigned int flags)
+ 	long current;
+ 	bool lastmatchnonzero;
+ 	char *mb_indices = NULL;
+	const char *fname = NULL;	// for fatal message, below
+ 
+ 	if ((flags & GENSUB) != 0) {
+ 		double d;
+ 		NODE *glob_flag;
+ 
+		fname = "gensub";
+ 		check_exact_args(nargs, "gensub", 4);
+ 
+ 		tmp = PEEK(3);
+@@ -3033,11 +3035,9 @@ do_sub(int nargs, unsigned int flags)
+ 		}
+ 		DEREF(glob_flag);
+ 	} else {
+-		if ((flags & GSUB) != 0) {
+-			check_exact_args(nargs, "gsub", 3);
+-		} else {
+-			check_exact_args(nargs, "sub", 3);
+-		}
+		fname = ((flags & GSUB) != 0) ? "gsub" : "sub";
+
+		check_exact_args(nargs, fname, 3);
+ 
+ 		/* take care of regexp early, in case re_update is fatal */
+ 
+@@ -3153,6 +3153,21 @@ do_sub(int nargs, unsigned int flags)
+ 		 * vary since ampersand is actual text of regexp match.
+ 		 */
+ 
+		// 4/2026: This overflow check simply provides a fatal
+		// message instead of letting realloc() die later after
+		// a buffer overrun.  It simply makes the user experience better,
+		// but does not prevent gawk from dying miserably.  I suppose
+		// it's worth the trouble, but just barely.
+
+		/* uint64_t so the product is 64-bit even on 32-bit ILP32 builds */
+		uint64_t repl_contribution =
+			(uint64_t)(unsigned int)ampersands
+			* (uint64_t)(uintptr_t)(matchend - matchstart);
+		if (repl_contribution > (uint64_t)SIZE_MAX
+		    || repl_contribution > (uint64_t)SIZE_MAX - (size_t)(matchend - text)
+						- repllen - 1)
+			fatal(_("%s: replacement expansion too large"), fname);
+
+ 		/*
+ 		 * add 1 to len to handle "empty" case where
+ 		 * matchend == matchstart and we force a match on a single
+-- 
+2.44.4
+
@@ -24,6 +24,7 @@ SRC_URI = "${GNU_MIRROR}/gawk/gawk-${PV}.tar.gz \
           file://0001-Fix-some-C23-compilatio-issues.patch \
           file://CVE-2026-40467.patch \
           file://CVE-2026-40468.patch \
+           file://CVE-2026-40469.patch \
           "

 SRC_URI[sha256sum] = "378f8864ec21cfceaa048f7e1869ac9b4597b449087caf1eb55e440d30273336"