Accepting request 1037649 from Base:System

OBS-URL: https://build.opensuse.org/request/show/1037649
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/busybox?expand=0&rev=80

busybox.changes

@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Wed Nov 23 13:24:55 UTC 2022 - Dominique Leuenberger <dimstar@opensuse.org>
+
+- Add e63d7cdf.patch: awk: fix use after free (CVE-2022-30065,
+  boo#1199744).
+
 -------------------------------------------------------------------
 Mon Nov 14 08:52:35 UTC 2022 - Radoslav Kolev <radoslav.kolev@suse.com>
 

busybox.spec

@@ -42,6 +42,8 @@ Source7:        busybox.config.static.warewulf3
 Patch0:         cpio-long-opt.patch
 Patch1:         sendmail-ignore-F-option.patch
 Patch2:         testsuite-gnu-echo.patch
+# PATCH-FIX-UPSTREAM e63d7cdf.patch CVE-2022-30065 - awk: fix use after free (rebased https://github.com/mirror/busybox/commit/e63d7cdf.patch)
+Patch3:         e63d7cdf.patch
 # other patches
 Patch100:       busybox.install.patch
 Provides:       useradd_or_adduser_dep

cpio-long-opt.patch

@@ -1,7 +1,8 @@
-diff -urN busybox-1.32.0.orig/archival/cpio.c busybox-1.32.0/archival/cpio.c
+Index: busybox-1.35.0/archival/cpio.c
---- busybox-1.32.0.orig/archival/cpio.c	2020-06-26 20:47:44.000000000 +0200
+===================================================================
-+++ busybox-1.32.0/archival/cpio.c	2020-12-07 11:23:44.913676627 +0100
+--- busybox-1.35.0.orig/archival/cpio.c
-@@ -367,6 +367,9 @@
++++ busybox-1.35.0/archival/cpio.c
+@@ -413,6 +413,9 @@ int cpio_main(int argc UNUSED_PARAM, cha
  	const char *long_opts =
  		"extract\0"      No_argument       "i"
  		"list\0"         No_argument       "t"

e63d7cdf.patch

@@ -0,0 +1,46 @@
+From e63d7cdfdac78c6fd27e9e63150335767592b85e Mon Sep 17 00:00:00 2001
+From: Natanael Copa <ncopa@alpinelinux.org>
+Date: Fri, 17 Jun 2022 17:45:34 +0200
+Subject: [PATCH] awk: fix use after free (CVE-2022-30065)
+
+fixes https://bugs.busybox.net/show_bug.cgi?id=14781
+
+function                                             old     new   delta
+evaluate                                            3343    3357     +14
+
+Signed-off-by: Natanael Copa <ncopa@alpinelinux.org>
+Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
+---
+ editors/awk.c       | 3 +++
+ testsuite/awk.tests | 6 ++++++
+ 2 files changed, 9 insertions(+)
+
+Index: busybox-1.35.0/editors/awk.c
+===================================================================
+--- busybox-1.35.0.orig/editors/awk.c
++++ busybox-1.35.0/editors/awk.c
+@@ -3114,6 +3114,9 @@ static var *evaluate(node *op, var *res)
+ 
+ 		case XC( OC_MOVE ):
+ 			debug_printf_eval("MOVE\n");
++			/* make sure that we never return a temp var */
++			if (L.v == TMPVAR0)
++				L.v = res;
+ 			/* if source is a temporary string, jusk relink it to dest */
+ 			if (R.v == TMPVAR1
+ 			 && !(R.v->type & VF_NUMBER)
+Index: busybox-1.35.0/testsuite/awk.tests
+===================================================================
+--- busybox-1.35.0.orig/testsuite/awk.tests
++++ busybox-1.35.0/testsuite/awk.tests
+@@ -469,4 +469,10 @@ testing 'awk printf %% prints one %' \
+ 	"%\n" \
+ 	'' ''
+ 
++testing 'awk assign while test' \
++	"awk '\$1==\$1=\"foo\" {print \$1}'" \
++	"foo\n" \
++	"" \
++	"foo"
++
+ exit $FAILCOUNT