Fix crash when ROC was passed a non-number where a number was expected.

Found by zzuf.

diff --git a/src/language/stats/roc.c b/src/language/stats/roc.c
index cf8d9371ca1317ce17397bfbb97afff066a58063..b8086dd6599b4e3d679034db53ef905b75df89d5 100644 (file)
--- a/src/language/stats/roc.c
+++ b/src/language/stats/roc.c
@@ -237,15 +237,19 @@ cmd_roc (struct lexer *lexer, struct dataset *ds)
                }
              else if (lex_match_id (lexer, "CI"))
                {
-                 lex_force_match (lexer, T_LPAREN);
-                 lex_force_num (lexer);
+                 if (!lex_force_match (lexer, T_LPAREN))
+                   goto error;
+                 if (! lex_force_num (lexer))
+                   goto error;
                  roc.ci = lex_number (lexer);
                  lex_get (lexer);
-                 lex_force_match (lexer, T_RPAREN);
+                 if (!lex_force_match (lexer, T_RPAREN))
+                   goto error;
                }
              else if (lex_match_id (lexer, "DISTRIBUTION"))
                {
-                 lex_force_match (lexer, T_LPAREN);
+                 if (!lex_force_match (lexer, T_LPAREN))
+                   goto error;
                  if (lex_match_id (lexer, "FREE"))
                    {
                      roc.bi_neg_exp = false;
@@ -259,7 +263,8 @@ cmd_roc (struct lexer *lexer, struct dataset *ds)
                      lex_error (lexer, NULL);
                      goto error;
                    }
-                 lex_force_match (lexer, T_RPAREN);
+                 if (!lex_force_match (lexer, T_RPAREN))
+                   goto error;
                }
              else
                {

diff --git a/tests/language/stats/roc.at b/tests/language/stats/roc.at
index f8d41ba75d93c417e20ebc0b0c6d1ee8a8c9ff05..458edbc45ab5580dbc9e08fb6279cd453d96c567 100644 (file)
--- a/tests/language/stats/roc.at
+++ b/tests/language/stats/roc.at
@@ -183,3 +183,21 @@ roc x y By(a (1)
 AT_CHECK([pspp -o pspp.csv roc.sps], [1], [ignore])
 
 AT_CLEANUP
+
+
+AT_SETUP([ROC crash on invalid syntax])
+AT_DATA([roc.sps], [dnl
+data list notable list /x * y * a *.
+bggin data.
+1 1 2  
+1 2 28
+end data.
+
+
+roc x y by a (1)
+       /criteria = ci(y5)
+])
+
+AT_CHECK([pspp -O format=csv roc.sps], [1], [ignore])
+
+AT_CLEANUP