Re: Sv: awk: CONVFMT format string causes crash

On Fri, 2026-05-01 at 12:21 +0000, Atle Østrem Tøge via busybox wrote:
> To clarify: %n is a printf conversion specifier that writes the number of
> bytes written so far to the address of the next argument, it is unrelated
> to numeric width specifiers like %.2f.
> 
> BusyBox awk validates only the last character of CONVFMT,  "%nf" passes
> (last char 'f' is valid) and the full string reaches snprintf. "%n" alone
> is correctly rejected.
> 
> We reproduced the segfault by building current master (vda-linux/busybox_mirror)
> against musl libc (Alpine Linux container):
> 
>     $ ./busybox awk 'BEGIN { CONVFMT="%nf"; x=3.14; print x "" }'
>     Segmentation fault
> 
> The root cause is in fmt_num() in editors/awk.c.
> 
> - Atle
> 
> 

interesting enough gnu awk emits this

$ awk 'BEGIN { CONVFMT="%nf"; x=3.14; print x "" }'; echo $?
%nf
0

with CONVFMT and no error.

also for %p 

$ awk 'BEGIN { CONVFMT="%pf"; x=3.16; print x "" }'; echo $?
%pf
0

as for busybox
$ ./busybox awk 'BEGIN { CONVFMT="%pf"; x=3.16; print x "" }'; echo $?
0x3f
0

For both cases I have a patch ready to submit

Ulli
_______________________________________________
busybox mailing list
[email protected]
https://lists.busybox.net/mailman/listinfo/busybox