T-TEST: Fix use-after-free with TEMPORARY and independent samples.
authorBen Pfaff <blp@cs.stanford.edu>
Fri, 11 Mar 2011 06:53:17 +0000 (22:53 -0800)
committerBen Pfaff <blp@cs.stanford.edu>
Fri, 11 Mar 2011 06:57:29 +0000 (22:57 -0800)
commit12212dfd8afc14405274703b511c32d362ec0ab5
treede98c9b1cab492eeb099f492695fefe39bda012c
parentcc2f230e7056734a2f7db67fbf9646a549496021
T-TEST: Fix use-after-free with TEMPORARY and independent samples.

When TEMPORARY is in effect, proc_commit() destroys the temporary
dictionary.  This means that any procedure that does not somehow disable
temporary transformations and refers to a variable following proc_commit()
has a use-after-free error.

T-TEST has two different bugs of this type.  First, the loop that destroys
group statistics refers to destroyed variables.  This commit fixes this
problem by instead using variable aux data destructors to destroy group
statistics.

Second, when there is an independent variable, destroying its values
requires knowing the variable's width.  This commit fixes this problem by
destroying the values before calling proc_commit().

The AUTORECODE, DESCRIPTIVES, RANK, and REGRESSION procedures appear to
have similar issues (not fixed by this commit).

Reported by Jeremy Lavergne <jeremy@lavergne.gotdns.org>.
src/language/stats/t-test.q
src/math/group.c