bugPSPP - Bugs: bug #62981, divide by zero in xtimes

 
 

bug #62981: divide by zero in xtimes

Submitter:  han zheng <kdsj>
Submitted:  Mon 29 Aug 2022 06:19:40 PM UTC
 
Category:  None Severity:  5 - Average
Status:  None Assigned to:  None
Open/Closed:  Open Release:  None
Effort:  0.00
* Mandatory Fields

Add a New Comment (Rich Markup)
   

Comment Type & Canned Response:
       

 

Mon 29 Aug 2022 06:19:40 PM UTC, original submission:  

## brief summary

hello, I was testing my fuzzer and find a possible divide by zero in xtimes, gl/xsize.h. Unfortunately the poc cannot be reproduced, but I verified manually and found bug might exisits.

## Bug description

in utilities/pspp-dump-sav.c, line 1404

```
  if (size_overflow_p (xsum (1, xtimes (size, count))))

```
it calls xtimes, which is defined in gl/xsize.h

```
#define xtimes(N, ELSIZE) \
  ((N) <= SIZE_MAX / (ELSIZE) ? (size_t) (N) * (ELSIZE) : SIZE_MAX)
```

xtimes try to perform an overflow check, however ELSIZE can be 0, which might results in a divide by zero.

my poc can only prove that the ELSIZE can be zero in size_overflow_p , but it cannot be reproduced in my environment. I guess the reason can be I use clang's lto mode and gold linker to compile binary for fuzzing. But I believe the problem do exists.

## gdb log

```
gdb-peda$ set args pspp-dump-sav.fpe
gdb-peda$ b utilities/pspp-dump-sav.c:1404
Breakpoint 1 at 0x4d215f: utilities/pspp-dump-sav.c:1404. (6 locations)
gdb-peda$ r
Starting program: /home/kdsj/workspace/fuzz/verify/pspp-1.6.2/utilities/pspp-dump-sav pspp-dump-sav.fpe
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
File header record:
             Product name: @(#) SPSS DATA FILE GNU psble0.13.1 - x86_64-unknown-linux-g
              Layout code: 2
               Compressed: 1 (simple compression)
             Weight index: 0
          Number of cases: 40
         Compression bias: 100
            Creation date: 03 Sep 17
            Creation time: 09:57:13
               File label: ""
000000b4: variable record #1
        Width: 0 (numeric)
        Variable label: 1
        Missing values code: 0 (no missing values)
        Print format: 050800 (F8.0)
        Write format: 0508ff (F8.255)
        Name: SEX
        000000d0 Variable label: "Sex of subject  "
000000e8: variable record #2
        Width: 0 (numeric)
        Variable label: 1
        Missing values code: 0 (no missing values)
        Print format: 050800 (F8.0)
        Write format: 050800 (F8.0)
        Name: HEIGHT
        00000104 Variable label: "Height in millimeters   "
00000124: variable record #3
        Width: 0 (numeric)
        Variable label: 1
        Missing values code: 0 (no missing values)
        Print format: 58050801 (F8.1)
        Write format: 050801 (F8.1)
        Name: WEIGHT
        00000140 Variable label: "Weight in kilograms "
0000015c: variable record #4
        Width: 536870912 (string)
        Variable label: 1
        Missing values code: 0 (no missing values)
        Print format: 050802 (F8.2)
        Write format: 050802 (F8.2)
        Name: TEMPERAT
        00000178 Variable label: "Internal body temperature in degrees Celcius"
000001ac: value labels record
        2.121995790965272e-314/"": "Male"
        1/"": "Female"
        000001d4: apply to variables #1
000001e0: document record
        4 lines of documents
        000001e4: line 0: "This data set contains two data entry errors."
        00000234: line 1: "variable "height", case 30; and                          "
        00000284: line 2: "variapp  "weight", case 38."
        000002d4: line 3: "   (Entered 29 Dec"
00000328: Record 7, subtype 3, size=4, count=8
00000334: machine integer info
        Version: 0.13.1
        Machine code: -1
        Floating point representation: 1 (IEEE 754)
        Compression code: 1
        Endianness: 2 (little)
        Character code: 65001
00000358: Record 7, subtype 4, size=8, count=3
00000364: machine float info
        sysmis: -1.797693134862316e+308 (-0x1.fffffffffffffp+1023)
        highest: 1.797693134862316e+308 (0x1.fffffffffffffp+1023)
        lowest: -1.797693134862316e+308 (-0x1.ffffffffffffep+1023)
00000380: Record 7, subtype 11, size=4, count=12
0000038c: variable display parameters
        Var #0: measure=3 (scale), width=2, align=1 (right)
        Var #1: measure=3 (scale), width=8, align=1 (right)
        Var #2: measure=3 (scale), width=8, align=1 (right)
        Var #3: measure=3 (scale), width=8, align=1 (right)
000003c0: Record 7, subtype 13, size=65470465, count=0
000003cc: long variable names (short => long)
[----------------------------------registers-----------------------------------]
RAX: 0x603000000310 --> 0xbebebebebebebebe
RBX: 0x7fffffffdea0 --> 0x7fffffffde60 --> 0x200000001 --> 0x0
RCX: 0x2e ('.')
RDX: 0x603000000300 --> 0x2000001102 --> 0x0
RSI: 0x0
RDI: 0x603000000310 --> 0xbebebebebebebebe
RBP: 0x7fffffffe0f0 --> 0x2
RSP: 0x7fffffffd600 --> 0x41b58ab3
RIP: 0x4d3a6f (<main+12031>:    mov    rax,r12)
R8 : 0x7ffff7fba000 --> 0x52c748 --> 0x4a6510 (<_ZN11__sanitizer17ThreadContextBase6OnDeadEv>:  ret)
R9 : 0x0
R10: 0x3
R11: 0x201
R12: 0x0
R13: 0x3e7000100000000
R14: 0x3e70001
R15: 0x603000000310 --> 0xbebebebebebebebe
EFLAGS: 0x206 (carry PARITY adjust zero sign trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
   0x4d3a65 <main+12021>:       mov    r15,rax
   0x4d3a68 <main+12024>:       mov    rsi,r12
   0x4d3a6b <main+12027>:       imul   rsi,r14
=> 0x4d3a6f <main+12031>:       mov    rax,r12
   0x4d3a72 <main+12034>:       mul    r14
   0x4d3a75 <main+12037>:       mov    rax,rsi
   0x4d3a78 <main+12040>:       mov    rcx,0xffffffffffffffff
   0x4d3a7f <main+12047>:       cmovo  rax,rcx
[------------------------------------stack-------------------------------------]
0000| 0x7fffffffd600 --> 0x41b58ab3
0008| 0x7fffffffd608 --> 0x50c2a0 ("16 32 8 16 raw_value.i:1237 64 1 25 n_missing_values.i.i:1098 80 81 10 line.i:580 208 1 15 label_len.i:532 224 256 11 label.i:534 544 9 12 string.i:494 576 1024 15 buffer.i.i:1670 1728 4 16 integer.i."...)
0016| 0x7fffffffd610 --> 0x4d0b70 (<main>:      push   rbp)
0024| 0x7fffffffd618 --> 0x5da440 --> 0x0
0032| 0x7fffffffd620 --> 0x2242b80000000000
0040| 0x7fffffffd628 --> 0x2
0048| 0x7fffffffd630 --> 0x2
0056| 0x7fffffffd638 --> 0x7fffffffd700 --> 0x499fe3 (<__interceptor_free()+163>:       mov    r14,rax)
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value

Breakpoint 1, open_text_record (r=<optimized out>, size=0x3e70001, count=0x0) at utilities/pspp-dump-sav.c:1404
1404      if (size_overflow_p (xsum (1, xtimes (size, count))))
gdb-peda$ display count
1: count = 0x0
```

## Credit

Han Zheng (NCNIPC of China, Hexhive)

han zheng <kdsj>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #53629:  pspp-dump-sav.zip added by kdsj (684B - application/x-zip-compressed)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by kdsj (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

     

     

     

    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2022-08-29 kdsj Attached File- Added pspp-dump-sav.zip, #53629

    Back to the top


    Powered by Savane 3.9