awk: CONVFMT format string causes crash

Package: busybox
Version: 1.36.1 (also reproduced on current master)

When I set CONVFMT to a multi-specifier format string ending in a valid
float specifier and perform a float-to-string conversion, busybox awk crashes.

With a standard CONVFMT I get:

    $ busybox awk 'BEGIN { CONVFMT="%.6g"; x=3.14; print x "" }'
    3.14

But with the following input I get a segfault:

    $ busybox awk 'BEGIN { CONVFMT="%nf"; x=3.14; print x "" }'
    Segmentation fault

Note that CONVFMT="%n" alone is correctly rejected with "Invalid format
specifier", so the crash is specific to multi-specifier strings where the
terminal character is otherwise valid.

Tested on x86_64 Linux. Crash confirmed with AddressSanitizer (SEGV,
WRITE access in fmt_num() -> getvar_s() -> evaluate()).

- Sebastian Ellingsen & Atle Tøge, NTNU

_______________________________________________
busybox mailing list
[email protected]
https://lists.busybox.net/mailman/listinfo/busybox