[AUTO-CHERRYPICK] busybox: Address CVE-2023-42366 - branch main (#11122)

Co-authored-by: Ankita Pareek <56152556+Ankita13-code@users.noreply.github.com>

Author: CBL-Mariner-Bot

SPECS/busybox/CVE-2023-42366.patch

@@ -0,0 +1,32 @@
+From 5cf8b332429a1dd9afef3337bae92aeddaeff993 Mon Sep 17 00:00:00 2001
+From: Valery Ushakov <uwe@stderr.spb.ru>
+Date: Wed, 24 Jan 2024 22:24:41 +0300
+Subject: [PATCH] awk.c: fix CVE-2023-42366 (bug #15874)
+
+Make sure we don't read past the end of the string in next_token()
+when backslash is the last character in an (invalid) regexp.
+---
+ editors/awk.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/editors/awk.c b/editors/awk.c
+index 728ee8685..be48df7c7 100644
+--- a/editors/awk.c
++++ b/editors/awk.c
+@@ -1165,9 +1165,11 @@ static uint32_t next_token(uint32_t expected)
+ 					s[-1] = bb_process_escape_sequence((const char **)&pp);
+ 					if (*p == '\\')
+ 						*s++ = '\\';
+-					if (pp == p)
++					if (pp == p) {
++						if (*p == '\0')
++							syntax_error(EMSG_UNEXP_EOS);
+ 						*s++ = *p++;
+-					else
++					} else
+ 						p = pp;
+ 				}
+ 			}
+-- 
+2.34.1
+

SPECS/busybox/busybox.spec

@@ -1,7 +1,7 @@
 Summary:        Statically linked binary providing simplified versions of system commands
 Name:           busybox
 Version:        1.35.0
-Release:        11%{?dist}
+Release:        12%{?dist}
 License:        GPLv2
 Vendor:         Microsoft Corporation
 Distribution:   Mariner
@@ -18,9 +18,10 @@ Patch5:         ash-fix-use-after-free-in-bash-pattern-substitution.patch
 Patch6:         selinux-copy-file.patch
 Patch7:         selinux-cp-a.patch
 Patch8:         CVE-2021-42380.patch
-# Also Fixes CVE-2023-42364
 Patch9:         CVE-2023-42363.patch
+# Also Fixes CVE-2023-42364
 Patch10:        CVE-2023-42365.patch
+Patch11:        CVE-2023-42366.patch
 BuildRequires:  gcc
 BuildRequires:  glibc-static >= 2.35-7%{?dist}
 BuildRequires:  libselinux-devel >= 1.27.7-2
@@ -100,6 +101,9 @@ install -m 644 docs/busybox.petitboot.1 %{buildroot}/%{_mandir}/man1/busybox.pet
 %{_mandir}/man1/busybox.petitboot.1.gz
 
 %changelog
+* Fri Nov 15 2024 Ankita Pareek <ankitapareek@microsoft.com> - 1.35.0-12
+- Address CVE-2023-42366
+
 * Tue Aug 13 2024 Suresh Thelkar <sthelkar@microsoft.com> - 1.35.0-11
 - Address CVE-2021-42380, CVE-2023-42363, CVE-2023-42364 & CVE-2023-42365