bin/57013: data corruption in awk

[dholland%NetBSD.org@localhost]

>Number:         57013
>Category:       bin
>Synopsis:       data corruption in awk
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Sep 16 23:40:01 +0000 2022
>Originator:     David A. Holland
>Release:        NetBSD 9.99.97 (20220602)
>Organization:
>Environment:
System: NetBSD valkyrie 9.99.97 NetBSD 9.99.97 (VALKYRIE) #10: Thu Aug 18 04:09:11 EDT 2022  dholland@valkyrie:/usr/src/sys/arch/amd64/compile/VALKYRIE amd64
Architecture: x86_64
Machine: amd64
>Description:

Running the included script prints, in addition to the paths in the
input, "dev WRONG". That is, the iteration over the exists[] array
produces a value that's not in it.

The assembly of a partial path prefix in the following logic does not
alter the array (or in fact do anything but compute some values that
are then discarded) but it causes the misbehavior in that the problem
goes away if it's removed.

gawk does not exhibit the behavior so it's probably not just that I've
done something stupid.

Probably memory corruption.

>How-To-Repeat:

#!/bin/sh

(
    echo bin
    echo bin/date
    echo bin/mv
    echo bin/sh
    echo dev/null
) | awk '

{ exists[$1] = 1; }
END {
    for (path in exists) {
        n = split(path, c, "/");
        print path, exists[path] ? "ok" : "WRONG";
        for (i=1;i<=n;i++) {
            x="";
            sep="";
            for (j=1;j<=i;j++) {
                x = x sep c[j];
                sep = "/"
            }
            if (exists[x]) {}
            else {}
        }
    }
}
'

>Fix:

Not a clue.