Sv: awk: CONVFMT format string causes crash

To clarify: %n is a printf conversion specifier that writes the number of
bytes written so far to the address of the next argument, it is unrelated
to numeric width specifiers like %.2f.

BusyBox awk validates only the last character of CONVFMT,  "%nf" passes
(last char 'f' is valid) and the full string reaches snprintf. "%n" alone
is correctly rejected.

We reproduced the segfault by building current master (vda-linux/busybox_mirror)
against musl libc (Alpine Linux container):

    $ ./busybox awk 'BEGIN { CONVFMT="%nf"; x=3.14; print x "" }'
    Segmentation fault

The root cause is in fmt_num() in editors/awk.c.

- Atle
________________________________
Fra: Michael D. Setzer II <[email protected]>
Sendt: fredag 1. mai 2026 13:53
Til: Atle Østrem Tøge via busybox <[email protected]>; Atle Østrem Tøge <[email protected]>; Busybox <[email protected]>
Kopi: Sebastian Ellingsen <[email protected]>
Emne: Re: awk: CONVFMT format string causes crash

On 1 May 2026 at 11:08, Atle Østrem Tøge via busyb wrote:

To:     Busybox <[email protected]>
Copies to:      Sebastian Ellingsen <[email protected]>
Subject:        awk: CONVFMT format string causes crash
Date sent:      Fri, 1 May 2026 11:08:59 +0000
From:   Atle Østrem Tøge via busybox <[email protected]>
Send reply to:  Atle Østrem Tøge <[email protected]>

>
> Package: busybox
> Version: 1.36.1 (also reproduced on current master)
>
> When I set CONVFMT to a multi-specifier format string ending in a valid
> float specifier and perform a float-to-string conversion, busybox awk crashes.
>
> With a standard CONVFMT I get:
>
>   $ busybox awk 'BEGIN { CONVFMT="%.6g"; x=3.14; print x "" }'
>   3.14
>
> But with the following input I get a segfault:
>
>   $ busybox awk 'BEGIN { CONVFMT="%nf"; x=3.14; print x "" }'
>   Segmentation fault
>

This is with latest 1.38 git snapshot build.
Belief the %nf should have the n replaced with a number?
./busybox awk 'BEGIN { CONVFMT="%.2f"; x=3.14; print x "" }'
3.14

With Fedora 43 awk get this with %nf
awk 'BEGIN { CONVFMT="%nf"; x=3.14; print x "" }'
%nf

So doesn't get a segment fault, but print %nf instead of number?


> Note that CONVFMT="%n" alone is correctly rejected with "Invalid format
> specifier", so the crash is specific to multi-specifier strings where the
> terminal character is otherwise valid.
>
> Tested on x86_64 Linux. Crash confirmed with AddressSanitizer (SEGV,
> WRITE access in fmt_num() -> getvar_s() -> evaluate()).
>
> - Sebastian Ellingsen & Atle Tøge, NTNU


+------------------------------------------------------------+
 Michael D. Setzer II - Computer Science Instructor (Retired)
 mailto:[email protected]
 mailto:[email protected]
 mailto:[email protected]
 Guam - Where America's Day Begins
 G4L Disk Imaging Project maintainer
 http://sourceforge.net/projects/g4l/
+------------------------------------------------------------+

_______________________________________________
busybox mailing list
[email protected]
https://lists.busybox.net/mailman/listinfo/busybox