mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-08-30 00:26:36 +00:00
Code Issues Projects Releases Wiki Activity

gawk: Fix CVE-2026-40467

Browse Source 
This patch applies the upstream fix as referenced in [2], using the commit shown in [1].

[1] https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=a2d18c74109e41bec29a23098eba2e00057286d8
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-40467

(From OE-Core rev: 157c0642e924dc5f53064322ad8b8143a3621d6b)

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Reviewed-by: Leonid Iziumtsev <leonid.iziumtsev@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Darsh Kelaiya
2026-07-22 02:56:24 -07:00
committed by Paul Barker
parent 337c659854
commit a59438acc8
2 changed files with 64 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-extended/gawk/gawk/CVE-2026-40467.patch
+63
View File
@@ -0,0 +1,63 @@
From 22fd9e360251f70b34e9b46635b6d75bce49202f Mon Sep 17 00:00:00 2001
From: "Arnold D. Robbins" <arnold@skeeve.com>
Date: Fri, 3 Apr 2026 12:02:11 +0300
Subject: [PATCH] Small memory management fix in io.c.
CVE: CVE-2026-40467
Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=a2d18c74109e41bec29a23098eba2e00057286d8]
(cherry picked from commit a2d18c74109e41bec29a23098eba2e00057286d8)
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
ChangeLog | 6 ++++++
io.c | 5 ++++-
2 files changed, 10 insertions(+), 1 deletion(-)
diff --git a/ChangeLog b/ChangeLog
index 2fa8b2f0..6bc88ebb 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2026-04-03 Arnold D. Robbins <arnold@skeeve.com>
+
+ * io.c (do_getline_redir): Don't DEREF redir_exp too early.
+ Thanks to Michał Majchrowicz <mmajchrowicz@afine.com>
+ for the report.
+
2023-11-02 Arnold D. Robbins <arnold@skeeve.com>
* 5.3.0: Release tar ball made.
diff --git a/io.c b/io.c
index 44671ebd..4db4b21d 100644
--- a/io.c
+++ b/io.c
@@ -2836,22 +2836,25 @@ do_getline_redir(int into_variable, enum redirval redirtype)
assert(redirtype != redirect_none);
redir_exp = TOP();
rp = redirect(redir_exp, redirtype, & redir_error, false);
- DEREF(redir_exp);
decr_sp();
if (rp == NULL) {
if (redir_error) { /* failed redirect */
if (! do_traditional)
update_ERRNO_int(redir_error);
}
+ DEREF(redir_exp);
return make_number((AWKNUM) -1.0);
} else if ((rp->flag & RED_TWOWAY) != 0 && rp->iop == NULL) {
if (is_non_fatal_redirect(redir_exp->stptr, redir_exp->stlen)) {
update_ERRNO_int(EBADF);
+ DEREF(redir_exp);
return make_number((AWKNUM) -1.0);
}
(void) close_rp(rp, CLOSE_ALL);
+ DEREF(redir_exp); // we're about to die, but what the heck, release it anyway
fatal(_("getline: attempt to read from closed read end of two-way pipe"));
}
+ DEREF(redir_exp);
iop = rp->iop;
if (iop == NULL) /* end of input */
return make_number((AWKNUM) 0.0);
--
2.44.4
meta/recipes-extended/gawk/gawk_5.3.0.bb
+1
View File
@@ -22,6 +22,7 @@ SRC_URI = "${GNU_MIRROR}/gawk/gawk-${PV}.tar.gz \
file://0001-m4-readline-add-missing-includes.patch \
file://run-ptest \
file://0001-Fix-some-C23-compilatio-issues.patch \
file://CVE-2026-40467.patch \
"
SRC_URI[sha256sum] = "378f8864ec21cfceaa048f7e1869ac9b4597b449087caf1eb55e440d30273336"