bugPSPP - Bugs: bug #67072, Bad-Free Vulnerability in...

 
 

bug #67072: Bad-Free Vulnerability in pspp-convert: Uninitialized Memory Free Attempt

Submitter:  Nez <xu_dawn>
Submitted:  Sat 03 May 2025 11:35:47 AM UTC
   
 
Category:  None Severity:  5 - Average
Status:  None Assigned to:  None
Open/Closed:  Open Release:  None
Effort:  0.00
* Mandatory Fields

Add a New Comment Rich Markup
   

Sat 03 May 2025 11:35:47 AM UTC, original submission:  

Summary
Bad-Free Vulnerability in pspp-convert: Uninitialized Memory Free Attempt

Environment
PSPP version: master in Git Repository[commit:82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb]
OS: Ubuntu 20.04.6 LTS
Compiler: Clang-12.0.1


Steps to reproduce

# export CFLAGS="-g -O0 -fno-inline -fno-lto -fsanitize=address"
# export CXXFLAGS="-g -O0 -fno-inline -fno-lto -fsanitize=address"
# ./configure --prefix=$INSTALL_DIR --without-gui --disable-shared  --without-perl-module
# make -j64 & make install


root@9c4de30a2a30:pspp-82fb509/install/bin/pspp-convert -O csv --drop var1 --recode --delimiter / POC_PSPP_bad-free /dev/null
`POC_PSPP_bad-free': This system file does not indicate its own character encoding.  Using default encoding ANSI_X3.4-1968.  For best results, specify an encoding explicitly.  Use SYSFILE INFO with ENCODING="DETECT" to analyze the possible encodings.
`POC_PSPP_bad-free': File header claims 4 variable positions but 0 were read from file.
=================================================================
==2681342==ERROR: AddressSanitizer: attempting free on address which was not malloc()-ed: 0x7fa4dca13d98 in thread T0
    #0 0x49ec02 in free (/new-test/fuzzdir/fuz-pspp/pspp-0501-new/pspp-82fb509/install/bin/pspp-convert+0x49ec02)
    #1 0x4d32bb in parse_variables_option /new-test/fuzzdir/fuz-pspp/pspp-0501-new/pspp-82fb509/utilities/pspp-convert.c:91:7
    #2 0x4d131b in main /new-test/fuzzdir/fuz-pspp/pspp-0501-new/pspp-82fb509/utilities/pspp-convert.c:315:12
    #3 0x7fa4deff1d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #4 0x7fa4deff1e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #5 0x423fa4 in _start (/new-test/fuzzdir/fuz-pspp/pspp-0501-new/pspp-82fb509/install/bin/pspp-convert+0x423fa4)

Address 0x7fa4dca13d98 is a wild pointer.
SUMMARY: AddressSanitizer: bad-free (/new-test/fuzzdir/fuz-pspp/pspp-0501-new/pspp-82fb509/install/bin/pspp-convert+0x49ec02) in free
==2681342==ABORTING

POC
https://drive.google.com/file/d/1YPJLiBzOwVTcc2FzdawYxBJWGujwqy7o/view?usp=sharing


Credit
Xudong Cao (UCAS)

Nez <xu_dawn>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by xu_dawn (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    No changes have been made to this item

    Back to the top

    Powered by Savane 3.15-e283.
    Corresponding source code