bugPSPP - Bugs: bug #31346, Segmentation fault in ascii driver

 
 

bug #31346: Segmentation fault in ascii driver

Submitter:  John Darrington <jmd>
Submitted:  Sat 16 Oct 2010 09:18:46 AM UTC
   
 
Category:  Output Driver Severity:  7 - Major
Status:  Fixed Assigned to:  None
Open/Closed:  Closed Release:  None
Effort:  0.00
* Mandatory Fields

Add a New Comment Rich Markup
   

Tue 26 Oct 2010 04:47:57 AM UTC, comment #3: 

I found the problem and pushed a fix.

Ben Pfaff <blp>
Group administrator
Fri 22 Oct 2010 04:37:12 AM UTC, comment #2: 

The following patch:


diff --git a/src/output/ascii.c b/src/output/ascii.c
index c9f96b2..f2b5415 100644
--- a/src/output/ascii.c
+++ b/src/output/ascii.c
@@ -602,6 +602,8 @@ ascii_draw_line (void *a_, int bb[TABLE_N_AXES][2],
                                      styles[H][0], styles[H][1]);
   for (y = bb[V][0] + a->y; y < y1; y++)
     {
+      printf ("bb[H][0]=%d bb[H][1]=%d bb[V][0]=%d bb[V][1]=%d y=%d y1=%d length=%d\n",
+              bb[H][0], bb[H][1], bb[V][0], bb[V][1], y, y1, a->length);
       ascii_expand_line (a, y, x1);
       for (x = bb[H][0]; x < x1; x++)
         a->lines[y].chars[x] = value;


shows that the bb parameter to ascii_draw_line() is bogus:


...
bb[H][0]=36 bb[H][1]=37 bb[V][0]=0 bb[V][1]=1 y=38 y1=39 length=66
bb[H][0]=37 bb[H][1]=44 bb[V][0]=0 bb[V][1]=1 y=38 y1=39 length=66
bb[H][0]=44 bb[H][1]=45 bb[V][0]=0 bb[V][1]=1 y=38 y1=39 length=66
bb[H][0]=0 bb[H][1]=1 bb[V][0]=-2147483647 bb[V][1]=1 y=-2147483609 y1=39 length=66
...


Ben Pfaff <blp>
Group administrator
Fri 22 Oct 2010 04:28:37 AM UTC, comment #1: 

valgrind shows that the ascii driver is writing beyond the end of the page (792 bytes divided by 12 bytes per struct ascii_line is 66):


==28358== Invalid read of size 4
==28358==    at 0x4893E73: ascii_expand_line (ascii.c:669)
==28358==    by 0x4893C4C: ascii_draw_line (ascii.c:605)
==28358==    by 0x489A1FC: render_page_draw_cells (render.c:870)
==28358==    by 0x489A562: render_page_draw (render.c:952)
==28358==    by 0x48937C0: ascii_output_table_item (ascii.c:459)
==28358==    by 0x4893912: ascii_submit (ascii.c:490)
==28358==    by 0x48960E7: output_submit__ (driver.c:102)
==28358==    by 0x489CF4C: table_item_submit (table-item.c:78)
==28358==    by 0x489BC4B: tab_submit (tab.c:630)
==28358==    by 0x48341F0: do_summary_box (npar-summary.c:173)
==28358==    by 0x4833BF0: cmd_npar_tests (npar.c:385)
==28358==    by 0x480CCFF: cmd_parse_in_state (command.c:219)
==28358==    by 0x480D367: cmd_parse (command.c:150)
==28358==    by 0x804A4F0: main (main.c:139)
==28358==  Address 0x8c3d26c is 4 bytes after a block of size 792 alloc'd
==28358==    at 0x47EBF50: malloc (vg_replace_malloc.c:236)
==28358==    by 0x47EBFDA: realloc (vg_replace_malloc.c:525)
==28358==    by 0x49351C8: xrealloc (xmalloc.c:57)
==28358==    by 0x48929FC: xnrealloc (xalloc.h:137)
==28358==    by 0x489446A: ascii_open_page (ascii.c:818)
==28358==    by 0x48935E0: ascii_output_table_item (ascii.c:414)
==28358==    by 0x489388F: ascii_output_text (ascii.c:474)
==28358==    by 0x4893AE6: ascii_submit (ascii.c:544)
==28358==    by 0x48960E7: output_submit__ (driver.c:102)
==28358==    by 0x4896194: output_submit (driver.c:138)
==28358==    by 0x489E8BC: text_item_submit (text-item.c:88)
==28358==    by 0x480CA6F: cmd_parse_in_state (command.c:192)
==28358==    by 0x480D367: cmd_parse (command.c:150)
==28358==    by 0x804A4F0: main (main.c:139)


Ben Pfaff <blp>
Group administrator
Sat 16 Oct 2010 09:18:46 AM UTC, original submission:  

The syntax below, which happens to be a verbatim extract from tests/language/stats/npar.at, crashes when run with default settings from the command line.

The problem doesn't show up in the autotests, because the crash occurs in the ascii output driver whereas the tests use the csv driver.

DATA LIST NOTABLE LIST /x y w * .
BEGIN DATA.
1   2  1
2   1  3
3.1 1  4
3.2 2  1
4   2  2
5   3  1
1   4  2
.   5  1
END DATA.

WEIGHT BY w.

MISSING VALUES x (4).

NPAR TESTS
  CHISQUARE=x y(-2,5)
  /MISSING=ANALYSIS
  /STATISTICS=DESCRIPTIVES
  .

John Darrington <jmd>
Group administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by blp (Posted a comment)
  • -email is unavailable- added by jmd (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-10-26 blp StatusNone Fixed
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code