bugPSPP - Bugs: bug #54725, Assertion abort in pspp-dump-sav.c...

 
 

bug #54725: Assertion abort in pspp-dump-sav.c of libpspp

Submitter:  Peter Lemenkov <peter_lemenkov>
Submitted:  Tue 25 Sep 2018 11:19:13 AM UTC
   
 
Category:  System/Portable File I/O Severity:  5 - Average
Status:  Fixed Assigned to:  None
Open/Closed:  Closed Release:  None
Effort:  0.00
* Mandatory Fields

Add a New Comment Rich Markup
   

Wed 26 Sep 2018 09:05:24 PM UTC, comment #1: 

Thank you for the bug report.  I applied a fix to the master branch.

Ben Pfaff <blp>
Group administrator
Tue 25 Sep 2018 11:19:13 AM UTC, original submission:  

Description of problem:

There is a assertion abort  in pspp-dump-sav.c  of  libpspp.


Version-Release number of selected component (if applicable):

<= latest version

How reproducible:

./pspp-dump-sav POC2


Steps to Reproduce:

The information is as follows:

$./pspp-dump-sav POC2
File header record:
     Product name: @(#) SPSS DATA FILE MS Windows Release 12.0 spss$o32.dll   
      Layout code: 2
       Compressed: 1 (simple compression)
     Weight index: 2
  Number of cases: 10
Compression bias: 100
    Creation date: 30   
    Creation time: 14:34:58
       File label: ""
...
pspp-dump-sav: utilities/pspp-dump-sav.c:1645: void read_string(struct sfm_reader , char , size_t): Assertion `size > 0' failed.
Aborted

The GDB debugging information is as follows:

(gdb) set args POC2
(gdb) r
 ...
(gdb) s
read_string (r=<optimized out>, buffer=<optimized out>, size=<optimized out>) at utilities/pspp-dump-sav.c:1645
1645   assert (size > 0);
(gdb) n
pspp-dump-sav: utilities/pspp-dump-sav.c:1645: void read_string(struct sfm_reader , char , size_t): Assertion `size > 0' failed.

Program received signal SIGABRT, Aborted.
0x00007ffff709e1c7 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:55
55 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0  0x00007ffff709e1c7 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:55
#1  0x00007ffff709fe2a in __GI_abort () at abort.c:89
#2  0x00007ffff70970bd in __assert_fail_base (fmt=0x7ffff71f8f78 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n",
    assertion=assertion@entry=0x411fc9 "size > 0", file=file@entry=0x411fd2 "utilities/pspp-dump-sav.c",
    line=line@entry=1645, function=function@entry=0x411fec "void read_string(struct sfm_reader , char , size_t)")
    at assert.c:92
#3  0x00007ffff7097172 in __GI___assert_fail (assertion=0x411fc9 "size > 0", file=0x411fd2 "utilities/pspp-dump-sav.c",
    line=1645, function=0x411fec "void read_string(struct sfm_reader , char , size_t)") at assert.c:101
#4  0x000000000040c90d in read_string (r=<optimized out>, buffer=<optimized out>, size=<optimized out>)
    at utilities/pspp-dump-sav.c:1645
#5  read_variable_record (r=<optimized out>) at utilities/pspp-dump-sav.c:454
#6  main (argc=<optimized out>, argv=<optimized out>) at utilities/pspp-dump-sav.c:203


The vulnerability was triggered in read_string() at pspp-dump-sav.c:1645.

1643 read_string (struct sfm_reader *r, char *buffer, size_t size)
1644 {
1645   assert (size > 0);
1646   read_bytes (r, buffer, size - 1);
1647   buffer[size - 1] = '\0';
1648 }

Actual results:

crash

Expected results:

file contents dump

Additional info:

This vulnerability is detected by team OWL337, with our custom fuzzer collAFL. Please contact ganshuitao@gmail.com   and -email is unavailable- if you need more info about the team, the tool or the vulnerability.

Peter Lemenkov <peter_lemenkov>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #45092:  POC2 added by peter_lemenkov (528B - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by blp (Posted a comment)
  • -email is unavailable- added by peter_lemenkov (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-09-26 blp CategoryNone System/Portable File I/O
        StatusNone Fixed
        Open/ClosedOpen Closed
    2018-09-25 peter_lemenkov Attached File- Added POC2, #45092

    Back to the top

    Powered by Savane 3.13-4b48.
    Corresponding source code