Ben Pfaff [Sun, 24 Sep 2017 02:44:48 +0000 (19:44 -0700)]
Avoid unfounded warnings from GCC 7.2.
GCC thinks that these printf formats can produce output longer than the
buffer that is available for them. I think that it is wrong, but it is
easy enough to use larger (or variable-length) buffers, so this commit
does that.
Ben Pfaff [Wed, 20 Sep 2017 15:36:18 +0000 (08:36 -0700)]
SORT VARIABLES: Improve stability of sort.
The sort was being made "stable" by comparing variables' addresses in
memory. There's nothing particularly predictable about that, especially
from one malloc implementation to another. This commit fixes the stability
by comparing the variables' dictionary indexes instead.
Ben Pfaff [Sat, 23 Sep 2017 17:37:35 +0000 (10:37 -0700)]
compiler: Fix test for "optimize" attribute.
This was introduced with GCC 4.4. This fixes build warnings compiling with
Clang, which pretends to be GCC 4.3 and does not support the "optimize"
attribute.
duplicate 'const' declaration specifier [-Wduplicate-decl-specifier]
extern const char const examples_dir[];
^
is shown. I removed the duplicate const declaration to avoid the
warning.
Ben Pfaff [Sun, 10 Sep 2017 17:31:59 +0000 (10:31 -0700)]
pspp.appdata.xml: Update and upgrade.
I added a number of elements suggested by Richard Hughes way back in
August 2016, plus some automatically added by "appstream-util upgrade".
It looks like the whole file changed because appstream-util reindented it,
but if you view ignoring white space changes you can see that the actual
changes are much smaller.
added a description how to update linux distributions
The usual way to obtain pspp in linux distributions is to
use the pspp version which is part of the distribution. I
described ways to update the pspp version by using backports,
a ppa or creating a new binary package from a source package.
Ben Pfaff [Sun, 27 Aug 2017 19:31:05 +0000 (12:31 -0700)]
sys-file-reader: Avoid assert-fail for duplicate attribute names.
CVE-2017-12961.
See also https://bugzilla.redhat.com/show_bug.cgi?id=1482436.
See also http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-12961.
See also http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12961.
Found by team OWL337, using the collAFL fuzzer.
Ben Pfaff [Sun, 27 Aug 2017 19:30:50 +0000 (12:30 -0700)]
sys-file-reader: Better handle duplicate names without long names.
The reader did not properly handle the case where variable short names
had duplicates and the system file did not include long names. In this
case, the reader still tried to use the (duplicate) short names as the
long names, which could in some cases cause a secondary name collision in
the no-long-names case in parse_long_var_names(), and assert-failed.
This commit first fixes the handling of duplicate short names: it sets
the long name to the unique chosen short name, instead of the original
duplicate short name. Then as an additional measure it refactors the code
a little to always handle duplicates in rename_var_and_save_short_names().
I am not sure that that is necessary but it's a little bit of a code
cleanup anyhow.
CVE-2017-12960.
See also https://bugzilla.redhat.com/show_bug.cgi?id=1482433.
See also http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-12960.
See also http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12960.
Found by team OWL337, using the collAFL fuzzer.
Ben Pfaff [Sun, 27 Aug 2017 19:30:30 +0000 (12:30 -0700)]
sys-file-reader: Fully verify multiple response set names.
Until now, the code only checked the first character of the name, which
made it possible to assert-fail when the mrset was actually added.
CVE-2017-12959.
See also https://bugzilla.redhat.com/show_bug.cgi?id=1482432.
See also http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-12959.
See also http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12959.
Found by team OWL337, using the collAFL fuzzer.
Ben Pfaff [Sun, 27 Aug 2017 19:32:50 +0000 (12:32 -0700)]
data-out: Pass correct width to value_str() in output_AHEX().
AHEX16 is short enough to work as a short string, but output_AHEX() was
treating it as a long string, which caused string data to be dereferenced
as a pointer.
CVE-2017-12958.
See also https://bugzilla.redhat.com/show_bug.cgi?id=1482429.
See also http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-12958.
See also http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12958.
Found by team OWL337, using the collAFL fuzzer.
Ben Pfaff [Mon, 31 Jul 2017 13:52:53 +0000 (06:52 -0700)]
system-file-format: More string fields with null bytes spotted.
Manoharan <s.manoharan@auckland.ac.nz> reported that he has also seen
system files that contain string fields with compressed null bytes, so
reword the description to make this sound less exotic.
Ben Pfaff [Mon, 17 Jul 2017 04:07:33 +0000 (21:07 -0700)]
doc: Keep copyright and license comments from showing up in TeX output.
The "\input texinfo" line is what changes the comment syntax from TeX
syntax to Texinfo syntax, so it has to go before the @c comments or else
those comments show up in output produced by TeX.
Ben Pfaff [Sat, 15 Jul 2017 22:10:38 +0000 (15:10 -0700)]
Update to newest Gnulib.
Harry Thijssen reported an issue with the previous version on Windows.
John Darrington suggested an update, since the Gnulib developers have been
working through related problems.
Ben Pfaff [Tue, 4 Jul 2017 16:58:55 +0000 (12:58 -0400)]
sys-file-reader: Fix integer overflows in parse_long_string_missing_values().
Crafted system files caused integer overflow errors that in turn caused
aborts. This fixes the problem.
CVE-2017-10791.
See also https://bugzilla.redhat.com/show_bug.cgi?id=1467004.
See also https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=866890.
See also https://security-tracker.debian.org/tracker/CVE-2017-10791.
Found by team OWL337, using the collAFL fuzzer.
Ben Pfaff [Tue, 4 Jul 2017 16:54:47 +0000 (12:54 -0400)]
sys-file-reader: Avoid null dereference skipping bad extension record 18.
read_record() assumed that read_extension_record() never set its output
argument to NULL when it returned true, but this is possible in an error
case.
CVE-2017-10792.
See also https://bugzilla.redhat.com/show_bug.cgi?id=1467005.
See also https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=866890.
See also https://security-tracker.debian.org/tracker/CVE-2017-10792.
Reported by team OWL337, with fuzzer collAFL.
Ben Pfaff [Tue, 27 Jun 2017 21:52:40 +0000 (17:52 -0400)]
perl-module: Avoid VERSION redefinition warning from compiler.
If the PSPP version includes a suffix like "-pre1", then Perl will strip
that suffix from the version it passes to the compiler using -DVERSION=...,
and <config.h> will re-define it with the full version string. This causes
a warning.
This change avoids the warning. I am not yet aware of a new problem that
it causes.
projects / pspp / log