data-out: Pass correct width to value_str() in output_AHEX().

AHEX16 is short enough to work as a short string, but output_AHEX() was
treating it as a long string, which caused string data to be dereferenced
as a pointer.

CVE-2017-12958.
See also https://bugzilla.redhat.com/show_bug.cgi?id=1482429.
See also http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-12958.
See also http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12958.
Found by team OWL337, using the collAFL fuzzer.

diff --git a/NEWS b/NEWS
index 1ce6229c76a86eb34bc8c75936a5c6cf726e46aa..358960403f5f57328faf760efa36a2f7fda572c8 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -4,6 +4,10 @@ See the end for copying conditions.
 
 Please send PSPP bug reports to bug-gnu-pspp@gnu.org.
 
+Changes since 1.0.0:
+
+ * Bug fixes, including a fix for CVE-2017-12958.
+
 Changes from 0.11.0 to 1.0.0:
 
  * Translation updates.

diff --git a/src/data/data-out.c b/src/data/data-out.c
index 94e555cc8215aa048ea1754fdfeefa87b6344ca3..157335cbf4a82d2d184eac78655613ee8ecd20cd 100644 (file)
--- a/src/data/data-out.c
+++ b/src/data/data-out.c
@@ -615,7 +615,7 @@ static void
 output_AHEX (const union value *input, const struct fmt_spec *format,
              char *output)
 {
-  output_hex (value_str (input, format->w), format->w / 2, output);
+  output_hex (value_str (input, format->w / 2), format->w / 2, output);
 }
 \f
 /* Decimal and scientific formatting. */

diff --git a/tests/data/data-out.at b/tests/data/data-out.at
index f84e144928e74fbf1ef87eecb6c28fa5b4b71056..b6d3b88e4615d4a9d03319b8fa19be0b13ab0345 100644 (file)
--- a/tests/data/data-out.at
+++ b/tests/data/data-out.at
@@ -15689,3 +15689,22 @@ AT_CHECK([cat wkday-out.out], [0], [dnl
                                         .
 ])
 AT_CLEANUP
+
+dnl This checks for a regression where AHEX output would crash due to
+dnl dereferencing string data as a pointer, for string widths between
+dnl 5 and 8, inclusive.
+AT_SETUP([AHEX output bug])
+AT_DATA([ahex.sps], [
+DATA LIST NOTABLE /s (a8).
+BEGIN DATA.
+abcdefgh
+END DATA.
+FORMATS s (AHEX16).
+LIST.
+])
+AT_CHECK([pspp -O format=csv ahex.sps], [0], [dnl
+Table: Data List
+s
+6162636465666768
+])
+AT_CLEANUP