sys-file-reader: Fully verify multiple response set names.

Until now, the code only checked the first character of the name, which
made it possible to assert-fail when the mrset was actually added.

CVE-2017-12959.
See also https://bugzilla.redhat.com/show_bug.cgi?id=1482432.
See also http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-12959.
See also http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12959.
Found by team OWL337, using the collAFL fuzzer.

diff --git a/NEWS b/NEWS
index 358960403f5f57328faf760efa36a2f7fda572c8..8ef452009249fdcce98d30c5b42089e111173758 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -6,7 +6,7 @@ Please send PSPP bug reports to bug-gnu-pspp@gnu.org.
 
 Changes since 1.0.0:
 
- * Bug fixes, including a fix for CVE-2017-12958.
+ * Bug fixes, including fixes for CVE-2017-12958 and CVE-2017-12959.
 
 Changes from 0.11.0 to 1.0.0:
 

diff --git a/src/data/sys-file-reader.c b/src/data/sys-file-reader.c
index 2ad146e88025699879c4aa536252bd8f3bd0ddf6..dbc61345a85869eda4c0d1eb7f0f0aa04fe4c9ce 100644 (file)
--- a/src/data/sys-file-reader.c
+++ b/src/data/sys-file-reader.c
@@ -1831,10 +1831,9 @@ decode_mrsets (struct sfm_reader *r, struct dictionary *dict)
       size_t i;
 
       name = recode_string ("UTF-8", r->encoding, s->name, -1);
-      if (name[0] != '$')
+      if (!mrset_is_valid_name (name, dict_get_encoding (dict), false))
         {
-          sys_warn (r, -1, _("Multiple response set name `%s' does not begin "
-                             "with `$'."),
+          sys_warn (r, -1, _("Invalid multiple response set name `%s'."),
                     name);
           free (name);
           continue;

diff --git a/tests/data/sys-file-reader.at b/tests/data/sys-file-reader.at
index be4782284c0ef8c0a87d0994088c0fd7fe00e34c..8ca6d74494e846d1268b5afa5f7429c072590ac3 100644 (file)
--- a/tests/data/sys-file-reader.at
+++ b/tests/data/sys-file-reader.at
@@ -2539,9 +2539,9 @@ for variant in be le; do
 MRSETS /DISPLAY NAME=ALL.
 ])
   AT_CHECK([pspp -O format=csv sys-file.sps], [0], [dnl
-warning: `sys-file.sav': Multiple response set name `b' does not begin with `$'.
+warning: `sys-file.sav': Invalid multiple response set name `b'.
 
-warning: `sys-file.sav': Multiple response set name `e' does not begin with `$'.
+warning: `sys-file.sav': Invalid multiple response set name `e'.
 
 Table: Multiple Response Sets
 Name,Variables,Details