busybox: Address CVE-2023-42366 (microsoft#11025)

Signed-off-by: Ankita Pareek <[email protected]>
Co-authored-by: Ankita Pareek <[email protected]>

SPECS/busybox/CVE-2023-42366.patch

@@ -0,0 +1,32 @@
+From 5cf8b332429a1dd9afef3337bae92aeddaeff993 Mon Sep 17 00:00:00 2001
+From: Valery Ushakov <[email protected]>
+Date: Wed, 24 Jan 2024 22:24:41 +0300
+Subject: [PATCH] awk.c: fix CVE-2023-42366 (bug #15874)
+
+Make sure we don't read past the end of the string in next_token()
+when backslash is the last character in an (invalid) regexp.
+---
+ editors/awk.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/editors/awk.c b/editors/awk.c
+index 728ee8685..be48df7c7 100644
+--- a/editors/awk.c
++++ b/editors/awk.c
+@@ -1165,9 +1165,11 @@ static uint32_t next_token(uint32_t expected)
+ 					s[-1] = bb_process_escape_sequence((const char **)&pp);
+ 					if (*p == '\\')
+ 						*s++ = '\\';
+-					if (pp == p)
++					if (pp == p) {
++						if (*p == '\0')
++							syntax_error(EMSG_UNEXP_EOS);
+ 						*s++ = *p++;
+-					else
++					} else
+ 						p = pp;
+ 				}
+ 			}
+-- 
+2.34.1
+

SPECS/busybox/busybox.spec

@@ -1,7 +1,7 @@
 Summary:        Statically linked binary providing simplified versions of system commands
 Name:           busybox
 Version:        1.36.1
-Release:        8%{?dist}
+Release:        9%{?dist}
 License:        GPLv2
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -12,9 +12,10 @@ Source2:        busybox-petitboot.config
 Patch0:         busybox-1.31.1-stime-fix.patch
 Patch1:         CVE-2022-28391.patch
 Patch2:         CVE-2021-42380.patch
-# Also Fixes CVE-2023-42364
 Patch3:         CVE-2023-42363.patch
+# Also Fixes CVE-2023-42364
 Patch4:         CVE-2023-42365.patch
+Patch5:         CVE-2023-42366.patch
 BuildRequires:  gcc
 BuildRequires:  glibc-static >= 2.38-8%{?dist}
 BuildRequires:  libselinux-devel >= 1.27.7-2
@@ -103,6 +104,9 @@ SKIP_KNOWN_BUGS=1 ./runtest
 %{_mandir}/man1/busybox.petitboot.1.gz
 
 %changelog
+* Tue Nov 12 2024 Ankita Pareek <[email protected]> - 1.36.1-9
+- Address CVE-2023-42366
+
 * Mon Aug 26 2024 Rachel Menge <[email protected]> - 1.36.1-8
 - Update to build dep latest glibc-static version