From: Ben Pfaff <blp@cs.stanford.edu>
Date: Tue, 21 May 2013 05:14:54 +0000 (-0700)
Subject: DESCRIPTIVES: Avoid use-after-free with TEMPORARY and Z scores.
X-Git-Url: https://pintos-os.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=14e2a2db7534bfd419871984657cadfe8e846799;p=pspp

DESCRIPTIVES: Avoid use-after-free with TEMPORARY and Z scores.

This is not an ideal fix, but it avoids the use-after-free error that we
have had until now.

Bug #38786.
---

diff --git a/src/language/stats/descriptives.c b/src/language/stats/descriptives.c
index 94421ef1e9..de05d2b89b 100644
--- a/src/language/stats/descriptives.c
+++ b/src/language/stats/descriptives.c
@@ -1,5 +1,5 @@
 /* PSPP - a program for statistical analysis.
-   Copyright (C) 1997-2000, 2009-2012 Free Software Foundation, Inc.
+   Copyright (C) 1997-2000, 2009-2013 Free Software Foundation, Inc.
 
    This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -397,6 +397,13 @@ cmd_descriptives (struct lexer *lexer, struct dataset *ds)
             }
         }
 
+      /* It would be better to handle Z scores correctly (however we define
+         that) when TEMPORARY is in effect, but in the meantime this at least
+         prevents a use-after-free error.  See bug #38786.  */
+      if (proc_make_temporary_transformations_permanent (ds))
+        msg (SW, _("DESCRIPTIVES with Z scores ignores TEMPORARY.  "
+                   "Temporary transformations will be made permanent."));
+
       proto = caseproto_create ();
       for (i = 0; i < 1 + 2 * z_cnt; i++)
         proto = caseproto_add_width (proto, 0);
diff --git a/tests/language/stats/descriptives.at b/tests/language/stats/descriptives.at
index 9cc7ca0515..37b7d5a813 100644
--- a/tests/language/stats/descriptives.at
+++ b/tests/language/stats/descriptives.at
@@ -276,3 +276,48 @@ group,a,b,Za,Zb
 2.00,500.00,10000.00,1.10,1.10
 ])
 AT_CLEANUP
+
+dnl Ideally DESCRIPTIVES would not make temporary transformations permanent
+dnl as it does now (bug #38786), so these results are imperfect.  However,
+dnl this test does verify that DESCRIPTIVES does not crash in this situation
+dnl (as it once did).
+AT_SETUP([DESCRIPTIVES -- Z scores bug with TEMPORARY])
+AT_DATA([descriptives.sps], [dnl
+DATA LIST LIST NOTABLE /id abc.
+BEGIN DATA.
+1 3.5
+2 2.0
+3 2.0
+4 3.5
+5 3.0
+6 4.0
+7 5.0
+END DATA.
+
+TEMPORARY.
+SELECT IF id < 7 .
+
+DESCRIPTIVES /VAR=abc/SAVE.
+LIST.
+])
+AT_CHECK([pspp -O format=csv descriptives.sps], [0], [dnl
+descriptives.sps:15: warning: DESCRIPTIVES: DESCRIPTIVES with Z scores ignores TEMPORARY.  Temporary transformations will be made permanent.
+
+Table: Mapping of variables to corresponding Z-scores.
+Source,Target
+abc,Zabc
+
+Table: Valid cases = 6; cases with missing value(s) = 0.
+Variable,N,Mean,Std Dev,Minimum,Maximum
+abc,6,3.00,.84,2.00,4.00
+
+Table: Data List
+id,abc,Zabc
+1.00,3.50,.60
+2.00,2.00,-1.20
+3.00,2.00,-1.20
+4.00,3.50,.60
+5.00,3.00,.00
+6.00,4.00,1.20
+])
+AT_CLEANUP