bugPSPP - Bugs: bug #67069, Integer Overflow in pspp-convert...

 
 

bug #67069: Integer Overflow in pspp-convert leads to Crash

Submitter:  Nez <xu_dawn>
Submitted:  Fri 02 May 2025 01:07:43 PM UTC
   
 
Category:  None Severity:  5 - Average
Status:  None Assigned to:  None
Open/Closed:  Open Release:  None
Effort:  0.00
* Mandatory Fields

Add a New Comment Rich Markup
   

Fri 02 May 2025 01:07:43 PM UTC, original submission:  

Summary
pspp-convert does not correctly validate the input to the -l used for password brute-forcing encrypted syntax files. If an extremely large or negative number is provided, it causes an unreasonably large memory allocation attempt, which results in a crash.

Environment
PSPP version: master in Git Repository[commit:82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb]
OS: Ubuntu 20.04.6 LTS
Compiler: Clang-12.0.1


Steps to reproduce

# export CFLAGS="-g -O0 -fno-inline -fno-lto -fsanitize=address"
# export CXXFLAGS="-g -O0 -fno-inline -fno-lto -fsanitize=address"
# ./configure --prefix=$INSTALL_DIR --without-gui --disable-shared  --without-perl-module
# make -j64 & make install


root@9c4de30a2a30:./pspp-convert -O csv -a A -l -1 POC /dev/null
=================================================================
==2738934==ERROR: AddressSanitizer: requested allocation size 0xfffffffffffffffc (0x800 after adjustments for alignment, red zones etc.) exceeds maximum supported size of 0x10000000000 (thread T0)
    #0 0x49f072 in calloc (/new-test/fuzzdir/fuz-pspp-convert/pspp-convert+0x49f072)
    #1 0x4d22bf in decrypt_file /new-test/build-pspp/pspp-82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb/utilities/pspp-convert.c:456:22
    #2 0x4d0d98 in main /new-test/build-pspp/pspp-82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb/utilities/pspp-convert.c:286:11
    #3 0x7f8f6fa98d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

==2738934==HINT: if you don't care about these errors you may set allocator_may_return_null=1
SUMMARY: AddressSanitizer: allocation-size-too-big (/new-test/fuzzdir/fuz-pspp-convert/pspp-convert+0x49f072) in calloc
==2738934==ABORTING

POC
https://drive.google.com/file/d/12IIt8eR591Z8O1ABOCkT_jdXSWaBxMZx/view?usp=drive_link

Credit
Xudong Cao (UCAS)
Yuqing Zhang (UCAS, Zhongguancun Laboratory)

Nez <xu_dawn>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #57187:  POC-pspp-convert_allocation-size-too-big added by xu_dawn (244B - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by xu_dawn (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2025-05-02 xu_dawn Attached File- Added POC-pspp-convert_allocation-size-too-big, #57187

    Back to the top

    Powered by Savane 3.15-e283.
    Corresponding source code