bugPSPP - Bugs: bug #66486, Segmentation-violation at...

 
 

bug #66486: Segmentation-violation at src/language/commands/matrix.c:3505 in matrix_expr_evaluate_seq in pspp

Submitter:  frankz7 <frankz7>
Submitted:  Wed 27 Nov 2024 01:00:37 PM UTC
   
 
Category:  None Severity:  5 - Average
Status:  None Assigned to:  None
Open/Closed:  Open Release:  None
Effort:  0.00
* Mandatory Fields

Add a New Comment Rich Markup
   

Wed 27 Nov 2024 01:00:37 PM UTC, original submission:  

Segmentation-violation at src/language/commands/matrix.c:3505 in matrix_expr_evaluate_seq in pspp


Description


Dear developers,

We found the following Segmentation-violation bug on pspp, please confirm.

This bug is triggered when we use psppwith the -b option.

The latest version v2.0.1 also has this vulnerability.

The function to_scalar doesn't validate its inputs. If start\_, end\_, or by\_ are NULL or invalid, gsl_matrix_alloc may return a null pointer if invalid parameters are provided. The return value of gsl_matrix_alloc is not be checked. If the allocation fails, it may cause a crash.

src/language/commands/matrix.c:3505:

3489   long int start = to_scalar (start_);
3490   long int end = to_scalar (end_);
3491   long int by = by_ ? to_scalar (by_) : 1;
3492
3493   if (!by)
3494     {
3495       msg_at (SE, matrix_expr_location (e->subs[2]),
3496               _("The increment operand to : must be nonzero."));
3497       return NULL;
3498     }
3499
3500   long int n = (end >= start && by > 0 ? (end - start + by) / by
3501                 : end <= start && by < 0 ? (start - end - by) / -by
3502                 : 0);
3503   gsl_matrix *m = gsl_matrix_alloc (1, n);
3504   for (long int i = 0; i < n; i++)
3505     gsl_matrix_set (m, 0, i, start + i * by);
3506   return m;
3507 }

Version


# ./src/ui/terminal/pspp --version
pspp (GNU PSPP) 2.0.1
Copyright (C) 2023 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Written by Ben Pfaff, John Darrington, and Jason Stover.

PoC


poc1pspp

Reproduction


./src/ui/terminal/pspp -b --output=tmp.csv poc1pspp

use valgrind:


apt-get install texinfo
apt-get install valgrind
apt-get install gettext libcairo2-dev libpango1.0-dev libgtk-3-dev libgtksourceview-4-dev libgsl-dev

tar -xvzf pspp-2.0.1.tar.gz
mv pspp-2.0.1 pspp
cd pspp
CFLAGS="-g -ggdb3" CXXFLAGS="-g -ggdb3" ./configure --disable-shared --without-gui
make -j10

valgrind --leak-check=full --track-origins=yes ./src/ui/terminal/pspp -b --output=tmp.csv poc1pspp

or use address sanitizer:


CFLAGS="-g -ggdb3 -fsanitize=address" CXXFLAGS="-g -ggdb3 -fsanitize=address" ./configure --disable-shared --without-gui
make -j3

./src/ui/terminal/pspp -b --output=tmp.csv poc1pspp

Valgrind Log


# valgrind --leak-check=full --track-origins=yes /afltest/tmp/pspp2/src/ui/terminal/pspp -b --output=tmp.csv poc2
==2416634== Memcheck, a memory error detector
==2416634== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==2416634== Using Valgrind-3.18.1 and LibVEX; rerun with -h for copyright info
==2416634== Command: /afltest/tmp/pspp2/src/ui/terminal/pspp -b --output=tmp.csv poc2
==2416634==
poc2:1.6: error: Bad character U+0007 in input.
    1 | Matri
      |      ^
==2416634== Invalid read of size 8
==2416634==    at 0x4D19671: gsl_matrix_set (in /usr/lib/x86_64-linux-gnu/libgsl.so.27.0.0)
==2416634==    by 0x1C52D9: matrix_expr_evaluate_seq (matrix.c:3505)
==2416634==    by 0x1CB35E: matrix_expr_evaluate (matrix.c:4601)
==2416634==    by 0x1CDCD5: matrix_print_execute (matrix.c:5726)
==2416634==    by 0x1D8360: matrix_command_execute (matrix.c:8872)
==2416634==    by 0x1D8C95: cmd_matrix (matrix.c:9169)
==2416634==    by 0x13DD22: do_parse_command (command.c:244)
==2416634==    by 0x13D9C3: cmd_parse_in_state (command.c:150)
==2416634==    by 0x13DA9B: cmd_parse (command.c:165)
==2416634==    by 0x13C608: main (main.c:139)
==2416634==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==2416634==
****************************************************
You have discovered a bug in PSPP.  Please report this
to bug-gnu-pspp@gnu.org.  Please include this entire
message, plus several lines of output just above it.
For the best chance at having the bug fixed, also
include the syntax file that triggered it and a sample
of any data file used for input.
proximate cause:     Segmentation Violation
version:             GNU pspp 2.0.1
host_system:         x86_64-pc-linux-gnu
build_system:        x86_64-pc-linux-gnu
locale_dir:          /usr/local/share/locale
compiler version:    11.4.0
****************************************************
==2416634==
==2416634== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==2416634==    at 0x50A39FC: __pthread_kill_implementation (pthread_kill.c:44)
==2416634==    by 0x50A39FC: __pthread_kill_internal (pthread_kill.c:78)
==2416634==    by 0x50A39FC: pthread_kill@@GLIBC_2.34 (pthread_kill.c:89)
==2416634==    by 0x504F475: raise (raise.c:26)
==2416634==    by 0x13C80B: bug_handler (main.c:222)
==2416634==    by 0x504F51F: ??? (in /usr/lib/x86_64-linux-gnu/libc.so.6)
==2416634==    by 0x4D19670: gsl_matrix_set (in /usr/lib/x86_64-linux-gnu/libgsl.so.27.0.0)
==2416634==    by 0x1C52D9: matrix_expr_evaluate_seq (matrix.c:3505)
==2416634==    by 0x1CB35E: matrix_expr_evaluate (matrix.c:4601)
==2416634==    by 0x1CDCD5: matrix_print_execute (matrix.c:5726)
==2416634==    by 0x1D8360: matrix_command_execute (matrix.c:8872)
==2416634==    by 0x1D8C95: cmd_matrix (matrix.c:9169)
==2416634==    by 0x13DD22: do_parse_command (command.c:244)
==2416634==    by 0x13D9C3: cmd_parse_in_state (command.c:150)
==2416634==
==2416634== HEAP SUMMARY:
==2416634==     in use at exit: 239,563 bytes in 444 blocks
==2416634==   total heap usage: 827 allocs, 383 frees, 327,684 bytes allocated
==2416634==
==2416634== 48 bytes in 1 blocks are definitely lost in loss record 211 of 386
==2416634==    at 0x4848899: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==2416634==    by 0x4D1F927: gsl_matrix_alloc (in /usr/lib/x86_64-linux-gnu/libgsl.so.27.0.0)
==2416634==    by 0x1C5290: matrix_expr_evaluate_seq (matrix.c:3503)
==2416634==    by 0x1CB35E: matrix_expr_evaluate (matrix.c:4601)
==2416634==    by 0x1CDCD5: matrix_print_execute (matrix.c:5726)
==2416634==    by 0x1D8360: matrix_command_execute (matrix.c:8872)
==2416634==    by 0x1D8C95: cmd_matrix (matrix.c:9169)
==2416634==    by 0x13DD22: do_parse_command (command.c:244)
==2416634==    by 0x13D9C3: cmd_parse_in_state (command.c:150)
==2416634==    by 0x13DA9B: cmd_parse (command.c:165)
==2416634==    by 0x13C608: main (main.c:139)
==2416634==
==2416634== LEAK SUMMARY:
==2416634==    definitely lost: 48 bytes in 1 blocks
==2416634==    indirectly lost: 0 bytes in 0 blocks
==2416634==      possibly lost: 0 bytes in 0 blocks
==2416634==    still reachable: 237,499 bytes in 422 blocks
==2416634==         suppressed: 0 bytes in 0 blocks
==2416634== Reachable blocks (those to which a pointer was found) are not shown.
==2416634== To see them, rerun with: --leak-check=full --show-leak-kinds=all
==2416634==
==2416634== For lists of detected and suppressed errors, rerun with: -s
==2416634== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 0 from 0)
Segmentation fault

ASAN Log


=================================================================
==4123934==ERROR: AddressSanitizer: requested allocation size 0x2d79883459e88 (0x2d7988345ae88 after adjustments for alignment, red zones etc.) exceeds maximum supported size of 0x10000000000 (thread T0)
    #0 0x7f7694772887 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    #1 0x7f7693e6f4cc in gsl_block_alloc (/lib/x86_64-linux-gnu/libgsl.so.27+0x5e4cc)

==4123934==HINT: if you don't care about these errors you may set allocator_may_return_null=1
SUMMARY: AddressSanitizer: allocation-size-too-big ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145 in __interceptor_malloc
==4123934==ABORTING

Reference


https://www.gnu.org/software/pspp/
https://savannah.gnu.org/projects/pspp/

Environment


ubuntu:22.04
gcc version 11.4.0 (Ubuntu 11.4.0-1ubuntu1~22.04)
clang version 14.0.0-1ubuntu1.1
afl-fuzz++4.22a

Thanks for your time!

frankz7 <frankz7>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #56648:  poc1pspp added by frankz7 (224B - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by frankz7 (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2024-11-27 frankz7 Attached File- Added poc1pspp, #56648

    Back to the top

    Powered by Savane 3.14-962f.
    Corresponding source code