Fix bug found by fuzzer.

Thanks to Zhou Geng for reporting this bug as poc9 in the report here:
https://lists.gnu.org/archive/html/bug-gnu-pspp/2024-03/msg00015.html

diff --git a/src/data/dataset.c b/src/data/dataset.c
index 310e66ef57a52afd058c83f0e88868d51b155b7f..cdbf8a16d35d5660572e690c5f2f913032bf3b48 100644 (file)
--- a/src/data/dataset.c
+++ b/src/data/dataset.c
@@ -787,6 +787,7 @@ proc_cancel_temporary_transformations (struct dataset *ds)
       dict_unref (ds->dict);
       ds->dict = ds->permanent_dict;
       ds->permanent_dict = NULL;
+      ds->temporary = false;
 
       dataset_transformations_changed__ (ds, ds->permanent_trns_chain.n != 0);
       return true;
@@ -802,9 +803,9 @@ proc_cancel_all_transformations (struct dataset *ds)
 {
   bool ok;
   assert (ds->proc_state == PROC_COMMITTED);
+  proc_cancel_temporary_transformations (ds);
   ok = trns_chain_clear (&ds->permanent_trns_chain);
   ok = trns_chain_clear (&ds->temporary_trns_chain) && ok;
-  ds->temporary = false;
   for (size_t i = 0; i < ds->n_stack; i++)
     ok = trns_chain_uninit (&ds->stack[i]) && ok;
   ds->n_stack = 0;

diff --git a/tests/language/commands/temporary.at b/tests/language/commands/temporary.at
index 1d67b42809d760f7d26b6d8db341cb3333bfa0b1..6df09b4cf9c541dadef6e9b5073160791619af43 100644 (file)
--- a/tests/language/commands/temporary.at
+++ b/tests/language/commands/temporary.at
@@ -60,3 +60,23 @@ X
 9.00
 ])
 AT_CLEANUP
+
+dnl Tests for regression against a crash on this input (based on
+dnl that generated by a fuzzer).
+AT_SETUP([TEMPORARY crash])
+AT_DATA([temporary.sps], [dnl
+DATA LIST LIST NOTABLE /a b c d e f.
+TEMPORARY.
+DATA LIST LIST NOTABLE /a b c d e.
+BEGIN DATA.
+1 2 3 4 5
+END DATA.
+LIST.
+])
+AT_CHECK([pspp -o pspp.csv temporary.sps])
+AT_CHECK([cat pspp.csv], [0], [dnl
+Table: Data List
+a,b,c,d,e
+1.00,2.00,3.00,4.00,5.00
+])
+AT_CLEANUP