bugPSPP - Bugs: bug #67075, Heap Buffer Overflow in PSPP's ZIP...

 
 

bug #67075: Heap Buffer Overflow in PSPP's ZIP Reader Functionality

Submitter:  Nez <xu_dawn>
Submitted:  Sat 03 May 2025 11:54:46 AM UTC
   
 
Category:  None Severity:  5 - Average
Status:  None Assigned to:  None
Open/Closed:  Open Release:  None
Effort:  0.00
* Mandatory Fields

Add a New Comment Rich Markup
   

Sat 03 May 2025 11:54:46 AM UTC, original submission:  

Summary
Heap Buffer Overflow in PSPP's ZIP Reader Functionality

Environment
PSPP version: master in Git Repository[commit:82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb]
OS: Ubuntu 20.04.6 LTS
Compiler: Clang-12.0.1


Steps to reproduce

# export CFLAGS="-g -O0 -fno-inline -fno-lto -fsanitize=address"
# export CXXFLAGS="-g -O0 -fno-inline -fno-lto -fsanitize=address"
# ./configure --prefix=$INSTALL_DIR --without-gui --disable-shared  --without-perl-module
# make -j64 & make install


root@9c4de30a2a30:./pspp-output dir POC -O format=pdf
=================================================================
==1376775==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x621000013d90 at pc 0x00000043c8be bp 0x7fff8536b5c0 sp 0x7fff8536ad88
WRITE of size 6873 at 0x621000013d90 thread T0
    #0 0x43c8bd in fread (/new-test/fuzzdir/fuz-pspp-output_dir/pspp-output+0x43c8bd)
    #1 0x6c7a49 in inflate_read /new-test/program/download/pspp-2.0.1/src/libpspp/zip-reader.c:747:20
    #2 0x6c3bc4 in zip_member_read /new-test/program/download/pspp-2.0.1/src/libpspp/zip-reader.c:238:20
    #3 0x6c4271 in zip_member_read_all /new-test/program/download/pspp-2.0.1/src/libpspp/zip-reader.c:277:9
    #4 0x55aeed in spv_read_light_table /new-test/program/download/pspp-2.0.1/src/output/spv/spv.c:358:17
    #5 0x562a5e in pivot_table_open_light /new-test/program/download/pspp-2.0.1/src/output/spv/spv.c:386:17
    #6 0x561c92 in spv_read_table_item /new-test/program/download/pspp-2.0.1/src/output/spv/spv.c:532:13
    #7 0x561061 in spv_decode_container /new-test/program/download/pspp-2.0.1/src/output/spv/spv.c:620:14
    #8 0x55e500 in spv_decode_children /new-test/program/download/pspp-2.0.1/src/output/spv/spv.c:684:19
    #9 0x55e7c3 in spv_decode_children /new-test/program/download/pspp-2.0.1/src/output/spv/spv.c:697:12
    #10 0x55d53f in spv_heading_read /new-test/program/download/pspp-2.0.1/src/output/spv/spv.c:791:5
    #11 0x55cbf2 in spv_read /new-test/program/download/pspp-2.0.1/src/output/spv/spv.c:867:9
    #12 0x4d44e6 in read_and_filter_spv /new-test/program/download/pspp-2.0.1/utilities/pspp-output.c:195:15
    #13 0x4d2378 in run_directory /new-test/program/download/pspp-2.0.1/utilities/pspp-output.c:204:30
    #14 0x4d1329 in main /new-test/program/download/pspp-2.0.1/utilities/pspp-output.c:856:3
    #15 0x7f7fefeffd8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #16 0x7f7fefeffe3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #17 0x4250b4 in _start (/new-test/fuzzdir/fuz-pspp-output_dir/pspp-output+0x4250b4)

0x621000013d90 is located 0 bytes to the right of 4240-byte region [0x621000012d00,0x621000013d90)
allocated by thread T0 here:
    #0 0x4a00f2 in calloc (/new-test/fuzzdir/fuz-pspp-output_dir/pspp-output+0x4a00f2)
    #1 0x6c75e1 in inflate_init /new-test/program/download/pspp-2.0.1/src/libpspp/zip-reader.c:686:26

SUMMARY: AddressSanitizer: heap-buffer-overflow (/new-test/fuzzdir/fuz-pspp-output_dir/pspp-output+0x43c8bd) in fread
Shadow bytes around the buggy address:
  0x0c427fffa760: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fffa770: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fffa780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fffa790: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fffa7a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c427fffa7b0: 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fffa7c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fffa7d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fffa7e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fffa7f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fffa800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==1376775==ABORTING

POC
https://drive.google.com/file/d/1llTE7U8TEHz

Nez <xu_dawn>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by xu_dawn (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    No changes have been made to this item

    Back to the top

    Powered by Savane 3.15-26b0.
    Corresponding source code