bin/40689: awk(1) crash with RE and ^ anchor

[njoly%pasteur.fr@localhost]

>Number:         40689
>Category:       bin
>Synopsis:       awk(1) crash with RE and ^ anchor
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Feb 19 13:10:00 +0000 2009
>Originator:     Nicolas Joly
>Release:        NetBSD 5.99.7
>Organization:
Biological Software and Databanks.
Institut Pasteur, Paris.
>Environment:
System: NetBSD lanfeust.sis.pasteur.fr 5.99.7 NetBSD 5.99.7 (LANFEUST) #6: Wed 
Feb 18 15:20:18 CET 2009 
njoly%lanfeust.sis.pasteur.fr@localhost:/local/src/NetBSD/obj.amd64/sys/arch/amd64/compile/LANFEUST
 amd64
Architecture: x86_64
Machine: amd64
>Description:
While checking some unrelated program for a buffer overflow with electricfence
library, i noticed that an awk(1) command crashed ...

I had a look, and it seems that using a regular expression with a `^' anchor
triggers the problem. Note that i was unable to make it (luckily ?) crash
without electricfence control.

njoly@lanfeust [~]> awk '/^root:/' </etc/passwd 
root:*:0:0:Charlie &:/root:/bin/ksh
njoly@lanfeust [~]> LD_PRELOAD=/usr/pkg/lib/libefence.so awk '/^root:/' 
</etc/passwd
  Electric Fence 2.1 Copyright (C) 1987-1998 Bruce Perens.
zsh: segmentation fault (core dumped)  LD_PRELOAD=/usr/pkg/lib/libefence.so awk 
'/^root:/' < /etc/passwd

Without the anchor, it does work.

njoly@lanfeust [~]> awk '/root:/' </etc/passwd 
root:*:0:0:Charlie &:/root:/bin/ksh
toor:*:0:0:Bourne-again Superuser:/root:/bin/sh
njoly@lanfeust [~]> LD_PRELOAD=/usr/pkg/lib/libefence.so awk '/root:/' 
</etc/passwd 
  Electric Fence 2.1 Copyright (C) 1987-1998 Bruce Perens.
root:*:0:0:Charlie &:/root:/bin/ksh
toor:*:0:0:Bourne-again Superuser:/root:/bin/sh

>How-To-Repeat:
install devel/electricfence from pkgsrc, and run the following command:
LD_PRELOAD=/usr/pkg/lib/libefence.so awk '/^root:/' </etc/passwd
>Fix:
n/a