From e24d171d4ca100fa55c5390916e3e97eb31a29e8 Mon Sep 17 00:00:00 2001
From: Ben Pfaff <blp@cs.stanford.edu>
Date: Tue, 4 Jul 2017 13:13:15 -0400
Subject: [PATCH] tests: Add tests against regression for two previously fixed
 bugs.

---
 tests/automake.mk             |   2 ++
 tests/data/CVE-2017-10791.sav | Bin 0 -> 671 bytes
 tests/data/CVE-2017-10792.sav | Bin 0 -> 807 bytes
 tests/data/sys-file-reader.at |  26 ++++++++++++++++++++++++++
 4 files changed, 28 insertions(+)
 create mode 100644 tests/data/CVE-2017-10791.sav
 create mode 100644 tests/data/CVE-2017-10792.sav

diff --git a/tests/automake.mk b/tests/automake.mk
index 0f297f7ca0..58d4621762 100644
--- a/tests/automake.mk
+++ b/tests/automake.mk
@@ -245,6 +245,8 @@ tests_ui_syntax_gen_test_LDADD = \
 
 EXTRA_DIST += \
 	tests/coverage.sh \
+	tests/data/CVE-2017-10791.sav \
+	tests/data/CVE-2017-10792.sav \
 	tests/data/bcd-in.expected.cmp.gz \
 	tests/data/binhex-in.expected.cmp.gz \
 	tests/data/binhex-out.expected.gz \
diff --git a/tests/data/CVE-2017-10791.sav b/tests/data/CVE-2017-10791.sav
new file mode 100644
index 0000000000000000000000000000000000000000..6462081f326d2cdb2a16dbe140684188a11f454d
GIT binary patch
literal 671
zcmbtR!AiqG5ZzYAR=s*((1Tt|l8qn*p#iNZ6{L}h$3S+I)R-3b;L%_7FFf`O()uQu
zg&u?+eDLxzGjC?HoAdD`7+suQ%J?~s<!$s5$??PFPCmu*wW!j?r<GG(>cnd42Ln&q
zrM1OE1%tFKCD0W@?1LSUaMTK(ZzJW&$E1?J^24DDhga9s@E>3*?b}ATcOZzfXzBs}
zj(V`8uBh(L((LIV0^9jQ93r^~(wTeU3Fz>RX6hx<93uIhm-;phR;_GSUu%xZcg$Xz
zNnV=o=DGL3@~|~~PT7ACtudGG<EHs=a%_XHD(Lf_sn+9psy|ydw-~xi_(S^utxauA
rRww-XENiCoI!8X`*svDJ&yA@wj&s&`<V*PHE@u6}{K}xl@sjly5J7UX

literal 0
HcmV?d00001

diff --git a/tests/data/CVE-2017-10792.sav b/tests/data/CVE-2017-10792.sav
new file mode 100644
index 0000000000000000000000000000000000000000..e36df437569359e4a735eb9640153c910d12363c
GIT binary patch
literal 807
zcmbtRO-sW-5KU{fu_}naU_lRhDM>bh6vPB<MQK4AKkyjHZkw8>fmFnkf6;&8vHpQr
zXObE0LFmDOm)Uvq_6<8Z>h&G(`0zvow?QB-{X1XuuKQgv2*hKYMzhyk3{|4STnXE0
zTO!Z$Jf2CX9VLl?s2hgS0Mq~&tt!Fy$&;422~%N9+wDlVb9#ms{uAJe^H!s7ZW@RO
ze`rD2Yx>TbzQjJirJPfP3PAqu29UoVUl)x*m?(HtsWl95tEZ;O@J>*RcMud_Gnl_b
zDxFug>6zVWmdxH%M7yc@eXn(&s?`pAqE{1e06@+J>;gDGU?{!;f%6flXD!}ema(YP
za`FC6HR^Uqi=L=OfA-_^Up&alIeVnPg3SNroDbV{aF}tJk<3VDTxQ%)oCl$lF0>vM
rA+0K>JW}Ig3_Pz;6CVRV(YhE>J*NB&d;<Cj*OaH=pK9n)ol*V)B*%rX

literal 0
HcmV?d00001

diff --git a/tests/data/sys-file-reader.at b/tests/data/sys-file-reader.at
index a00ef2b46c..254de181ec 100644
--- a/tests/data/sys-file-reader.at
+++ b/tests/data/sys-file-reader.at
@@ -3873,3 +3873,29 @@ for variant in be le; do
 ])
 done
 AT_CLEANUP
+
+# CVE-2017-10791.
+# See also https://bugzilla.redhat.com/show_bug.cgi?id=1467004.
+# See also https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=866890.
+# See also https://security-tracker.debian.org/tracker/CVE-2017-10791.
+# Found by team OWL337, using the collAFL fuzzer.
+AT_SETUP([integer overflows in long string missing values])
+cp $top_srcdir/tests/data/CVE-2017-10791.sav .
+AT_CHECK([pspp-convert -O csv CVE-2017-10791.sav -], [0], [], [dnl
+`CVE-2017-10791.sav': This system file does not indicate its own character encoding.  Using default encoding ANSI_X3.4-1968.  For best results, specify an encoding explicitly.  Use SYSFILE INFO with ENCODING="DETECT" to analyze the possible encodings.
+`CVE-2017-10791.sav' near offset 0x217: Extension record subtype 21 ends unexpectedly.
+])
+AT_CLEANUP
+
+# CVE-2017-10792.
+# See also https://bugzilla.redhat.com/show_bug.cgi?id=1467005.
+# See also https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=866890.
+# See also https://security-tracker.debian.org/tracker/CVE-2017-10792.
+# Reported by team OWL337, with fuzzer collAFL.
+AT_SETUP([null dereference skipping bad extension record 18])
+cp $top_srcdir/tests/data/CVE-2017-10792.sav .
+AT_CHECK([pspp-convert -O csv CVE-2017-10792.sav -], [0], [], [dnl
+`CVE-2017-10792.sav' near offset 0x1c0: Record type 7, subtype 18 has bad size 4 (expected 1).
+`CVE-2017-10792.sav': This system file does not indicate its own character encoding.  Using default encoding ANSI_X3.4-1968.  For best results, specify an encoding explicitly.  Use SYSFILE INFO with ENCODING="DETECT" to analyze the possible encodings.
+])
+AT_CLEANUP
-- 
2.30.2