From 1e0b3ebeb4a39680dcd9c8eeadd8e3bf1c7c6200 Mon Sep 17 00:00:00 2001 From: "Arnold D. Robbins" Date: Sat, 4 Apr 2026 21:45:58 +0300 Subject: [PATCH] Minor integer overflow fixes. CVE: CVE-2026-40468 Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=062f2f2581b991362c046f7f2e238ffa34e6f8c7] (cherry picked from commit 062f2f2581b991362c046f7f2e238ffa34e6f8c7) Signed-off-by: Darsh Kelaiya --- ChangeLog | 8 ++++++++ builtin.c | 2 +- node.c | 2 +- 3 files changed, 10 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 517aba91..8cdf90f6 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,11 @@ +2026-04-04 Arnold D. Robbins + + * builtin.c (do_sub): Make `sofar' be size_t to avoid + integer overflows. Thanks to Michał Majchrowicz + for the report. + * node.c (parse_escape): Change `i' to int64_t to avoid + overflows. Thanks to ASan with gcc -m32. + 2026-04-03 Arnold D. Robbins * io.c (do_getline_redir): Don't DEREF redir_exp too early. diff --git a/builtin.c b/builtin.c index 6305b541..d0e083da 100644 --- a/builtin.c +++ b/builtin.c @@ -1806,7 +1806,7 @@ do_sub(int nargs, unsigned int flags) char *repl; char *replend; size_t repllen; - int sofar; + size_t sofar; int ampersands; int matches = 0; Regexp *rp; diff --git a/node.c b/node.c index 0e2bfb0f..f1e14dff 100644 --- a/node.c +++ b/node.c @@ -584,7 +584,7 @@ parse_escape(const char **string_ptr, const char **result, size_t *nbytes) static char buf[MB_LEN_MAX]; enum escape_results retval = ESCAPE_OK; int c = *(*string_ptr)++; - long i; + int64_t i; int count; int j; const char *start; -- 2.53.0