bugPSPP - Bugs: bug #32757, use-after-free with TEMPORARY in...

 
 

bug #32757: use-after-free with TEMPORARY in some procedures

Submitter:  Ben Pfaff <blp>
Submitted:  Sat 12 Mar 2011 04:58:06 PM UTC
   
 
Category:  Syntax Parser Severity:  5 - Average
Status:  Duplicate Assigned to:  None
Open/Closed:  Closed Release:  Before 0.8.0
Effort:  0.00
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Tue 28 May 2013 04:40:20 AM UTC, comment #7: 

Oops, the subissues are bug #38786, bug #38787, and bug #38788.

Ben Pfaff <blp>
Group administrator
Sat 20 Apr 2013 05:56:30 PM UTC, comment #6: 

I broke out the known issues into separate bugs (bug #32786, bug #32787, bug #32788), so I am closing this umbrella issue.

Ben Pfaff <blp>
Group administrator
Wed 17 Apr 2013 07:57:59 PM UTC, comment #5: 

jmd pointed out that AGGREGATE might need a look too.

Ben Pfaff <blp>
Group administrator
Wed 17 Apr 2013 05:35:48 AM UTC, comment #4: 


> I couldn't figure out what DESCRIPTIVES should actually do when SAVE and TEMPORARY are in use, so I asked a question on pspp-users. I hope to get a response.


The message I posted is at: http://lists.gnu.org/archive/html/pspp-users/2013-04/msg00029.html

Ben Pfaff <blp>
Group administrator
Wed 17 Apr 2013 05:26:49 AM UTC, comment #3: 

I couldn't figure out what DESCRIPTIVES should actually do when SAVE and TEMPORARY are in use, so I asked a question on pspp-users.  I hope to get a response.

Ben Pfaff <blp>
Group administrator
Wed 17 Apr 2013 05:13:30 AM UTC, comment #2: 

The problem in RANK should have been fixed already.  That leaves DESCRIPTIVES and REGRESSION.  I'm working on DESCRIPTIVES.  I haven't looked at REGRESSION yet.

Ben Pfaff <blp>
Group administrator
Sun 07 Apr 2013 10:07:04 PM UTC, comment #1: 

I fixed the problem in AUTORECODE.

Ben Pfaff <blp>
Group administrator
Sat 12 Mar 2011 04:58:06 PM UTC, original submission:  

A recent commit explains the issue:


commit 12212dfd8afc14405274703b511c32d362ec0ab5
Author: Ben Pfaff <blp@cs.stanford.edu>
Date:   Thu Mar 10 22:53:17 2011 -0800

    T-TEST: Fix use-after-free with TEMPORARY and independent samples.

    When TEMPORARY is in effect, proc_commit() destroys the temporary
    dictionary.  This means that any procedure that does not somehow disable
    temporary transformations and refers to a variable following proc_commit()
    has a use-after-free error.

    T-TEST has two different bugs of this type.  First, the loop that destroys
    group statistics refers to destroyed variables.  This commit fixes this
    problem by instead using variable aux data destructors to destroy group
    statistics.

    Second, when there is an independent variable, destroying its values
    requires knowing the variable's width.  This commit fixes this problem by
    destroying the values before calling proc_commit().

    The AUTORECODE, DESCRIPTIVES, RANK, and REGRESSION procedures appear to
    have similar issues (not fixed by this commit).

    Reported by Jeremy Lavergne <jeremy@lavergne.gotdns.org>.


Ben Pfaff <blp>
Group administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by blp (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2013-04-20 blp StatusNone Duplicate
        Open/ClosedOpen Closed
    2011-05-14 blp ReleaseNone Before 0.8.0

    Back to the top

    Powered by Savane 3.13-cf05.
    Corresponding source code