Ben Pfaff [Tue, 4 Jul 2017 16:54:47 +0000 (12:54 -0400)]
sys-file-reader: Avoid null dereference skipping bad extension record 18.
read_record() assumed that read_extension_record() never set its output
argument to NULL when it returned true, but this is possible in an error
case.
CVE-2017-10792.
See also https://bugzilla.redhat.com/show_bug.cgi?id=1467005.
See also https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=866890.
See also https://security-tracker.debian.org/tracker/CVE-2017-10792.
Reported by team OWL337, with fuzzer collAFL.
Ben Pfaff [Tue, 27 Jun 2017 21:52:40 +0000 (17:52 -0400)]
perl-module: Avoid VERSION redefinition warning from compiler.
If the PSPP version includes a suffix like "-pre1", then Perl will strip
that suffix from the version it passes to the compiler using -DVERSION=...,
and <config.h> will re-define it with the full version string. This causes
a warning.
This change avoids the warning. I am not yet aware of a new problem that
it causes.
Fixed perl regression problem due to Version name - Fixes Bug #51218
The regression failed in some perl tests due to an incompatible
pspp version number. I changed to a version number that includes
a "-". The problem is described in acinclude.m4. See
The PSPP autobuilder appends a build number to the PSPP version number,
e.g. "0.7.2-build40". But Perl won't parse version numbers that contain
anything other than digits and periods, so "-build" causes an error. So we
define $(VERSION_FOR_PERL) that drops everything from the hyphen onward.
VERSION_FOR_PERL=`echo "$VERSION" | sed 's/-.*//'`
AC_SUBST([VERSION_FOR_PERL])
The version name was 0.10.5pre1 without a "-". Therefore the version name
for perl results in a problem.
John Darrington [Wed, 10 May 2017 10:48:17 +0000 (12:48 +0200)]
FACTOR: Use consistent indexing when displaying matrices.
In any sane use case this will make no difference, since
all covariance and correlation matrices are symetrical.
However for correctness and ease of debugging this helps.
John Darrington [Fri, 24 Mar 2017 07:29:31 +0000 (08:29 +0100)]
Terminal interface: Remove support for the ncurses library.
This library was supported for trivial reasons. It always gave rise
to portability issues and was a pain to support. Furthermore there
is a simpler way to do what we used it for. So now we use that way
instead.
John Darrington [Tue, 7 Mar 2017 05:31:49 +0000 (06:31 +0100)]
Fixed a bug in the Mann-Whitney test vs. missing=analysis.
When missing values were deleted from the dataset, they were deleted after the
ranks for the U value had been inserted, - thus the wrong rank sum would be
calculated. This change deletes missing values *before* the ranks are inserted.
The issue this fixes is described at
http://lists.gnu.org/archive/html/pspp-users/2017-03/msg00009.html
The FREQUENCIES command output the mean instead of variance result when
variance was requested. The bug and a patch was reported on savannah.
I added a test to identify the problem and the proposed patch.
John Darrington [Sun, 21 Aug 2016 12:29:21 +0000 (14:29 +0200)]
Ensure that help page manifest is not empty.
For some reason I have found that sometimes doc/help-pages-list
is zero bytes long. I don't know how this happens, but this
change should catch it and allow us to find out why.
Ben Pfaff [Sun, 4 Dec 2016 21:31:44 +0000 (13:31 -0800)]
Update all translations using "make po-update".
This only adds an "X-Bugs:" line to the translations, which were otherwise
up-to-date except that cs.po and en_GB.po aren't actually in
translationproject. I'll have to ask John Darrington about that.
Ben Pfaff [Sat, 3 Dec 2016 06:24:06 +0000 (22:24 -0800)]
Fix misleadingly indented statements.
GCC 6.2.1 reported {}-braced blocks that looked like they were guarded by
preceding "if" statements but really weren't. This fixes the misleading
indentation.
This typo was reported in the mailing list in message:
http://lists.gnu.org/archive/html/bug-gnu-pspp/2016-11/msg00001.html
Thank you for reporting the typo!
This patch fixes the problem described in bug #49550. When libxml2 is
not installed, the gnumeric and odf read support is disabled. This was
not handled correctly. I changed the compilation requirements and the
error message handling if somebody tries to open a file.
added CFLAGS, CPPFLAGS and LDFLAGS for PSPP.C and q2c.c compilation
The hardening check during the debian build process showed that the
hardening compile flags are not issued to the compilation process of
PSPP.c (the perl module) and q2c.c (the lexer). Although q2c.c is only
relevant during the build process hardening this will not hurt.
The perl INC path in debian does not include the current directory
anymore. Therefore I added the current directory path at the places
where a module is called and it is assumed that . is part of INC.