bugPSPP - Bugs: bug #67073, Segmentation Fault in...

 
 

bug #67073: Segmentation Fault in spvxml_parse_attributes Due to Extra Content in XML Document

Submitter:  Nez <xu_dawn>
Submitted:  Sat 03 May 2025 11:43:26 AM UTC
   
 
Category:  None Severity:  5 - Average
Status:  None Assigned to:  None
Open/Closed:  Open Release:  None
Effort:  0.00
* Mandatory Fields

Add a New Comment Rich Markup
   

Sat 03 May 2025 11:43:26 AM UTC, original submission:  

Summary
Segmentation Fault in spvxml_parse_attributes Due to Extra Content in XML Document

Environment
PSPP version: master in Git Repository[commit:82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb]
OS: Ubuntu 20.04.6 LTS
Compiler: Clang-12.0.1


Steps to reproduce

# export CFLAGS="-g -O0 -fno-inline -fno-lto -fsanitize=address"
# export CXXFLAGS="-g -O0 -fno-inline -fno-lto -fsanitize=address"
# ./configure --prefix=$INSTALL_DIR --without-gui --disable-shared  --without-perl-module
# make -j64 & make install


root@9c4de30a2a30:./pspp-output dir POC -O format=pdf
Entity: line 1: parser error : Extra content at the end of the document

^
AddressSanitizer:DEADLYSIGNAL
=================================================================
==3129008==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000058 (pc 0x000000567432 bp 0x7ffd72c37010 sp 0x7ffd72c36f20 T0)
==3129008==The signal is caused by a READ memory access.
==3129008==Hint: address points to the zero page.
    #0 0x567432 in spvxml_parse_attributes /new-test/program/download/pspp-2.0.1/src/output/spv/spvxml-helpers.c
    #1 0x57f996 in spvsx_parse_root_heading /new-test/program/download/pspp-2.0.1/src/output/spv/structure-xml-parser.c:4907:5
    #2 0x55d31a in spv_heading_read /new-test/program/download/pspp-2.0.1/src/output/spv/spv.c:778:3
    #3 0x55cbf2 in spv_read /new-test/program/download/pspp-2.0.1/src/output/spv/spv.c:867:9
    #4 0x4d44e6 in read_and_filter_spv /new-test/program/download/pspp-2.0.1/utilities/pspp-output.c:195:15
    #5 0x4d2378 in run_directory /new-test/program/download/pspp-2.0.1/utilities/pspp-output.c:204:30
    #6 0x4d1329 in main /new-test/program/download/pspp-2.0.1/utilities/pspp-output.c:856:3
    #7 0x7fb5c5099d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #8 0x7fb5c5099e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #9 0x4250b4 in _start (/new-test/fuzzdir/fuz-pspp-output_dir/pspp-output+0x4250b4)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /new-test/program/download/pspp-2.0.1/src/output/spv/spvxml-helpers.c in spvxml_parse_attributes
==3129008==ABORTING

POC
https://drive.google.com/file/d/1ceaZpBD0mcBbjIVu3aAHeNB3y2iK-uSl/view?usp=sharing



Credit
Xudong Cao (UCAS)

Nez <xu_dawn>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by xu_dawn (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    No changes have been made to this item

    Back to the top

    Powered by Savane 3.15-26b0.
    Corresponding source code