Re: [PATCH] awk: fix use-after-free in awk_sub()

Hi Dmitry,

For a non-literal regexp, as_regex() does this:

  s = getvar_s(evaluate(op, TMPVAR));

evaluate() can run awk code before awk_sub() uses the replacement pointer
which exec_builtin() saved earlier.

For example:

  function re() {
      $10 = $NF
      return "x"
  }

  BEGIN {
      NF = 1
      sub(re(), NF, $1)
  }

The sequence is:

1. awk converts NF to the replacement string "1" and keeps a pointer to
   that cached string.
2. awk_sub() calls as_regex(), and evaluate() runs re().
3. Assigning to $10 updates NF from 1 to 10 and frees NF's cached string
   "1".
4. awk_sub() then calls strlen(repl), but repl still points to the freed
   string.

While checking this path, I found that v1 is too narrow. The same
earlier-operand/later-evaluation lifetime issue also affects match(),
split(), other multi-argument builtins, and evaluator operators. I am
fixing those instances of the same root cause together and will send v2
as a new thread soon.

Thanks,
Sanghyun