Hello,
We are developing a new fuzz testing feature, and it found an assertion bug in pspp.
Command to Reproduce
./pspp <input_file>
input_file is attached.
Command Output
... (omitted)
poc_file:1.106: error: Bad character U+0000 in input.
1 | goryBorderRoZsUUUUM
poc_file:1.106: error: Bad character U+0000 in input.
1 | goryBorderRoZsUUUUM
poc_file:1.106: error: Bad character U+0001 in input.
1 | goryBorderRoZsUUUUM
poc_file:1.106: error: Bad character U+0000 in input.
1 | goryBorderRoZsUUUUM
poc_file:1.106: error: Bad character U+0000 in input.
1 | goryBorderRoZsUUUUM
poc_file:1.106: error: Bad character U+0000 in input.
1 | goryBorderRoZsUUUUM
poc_file:1.106: error: Bad character U+0000 in input.
1 | goryBorderRoZsUUUUM
poc_file:1.106-1.107: error: Bad character U+FFFD in input.
1 | goryBorderRoZsUUUUM
poc_file:1.107: error: Bad character U+0000 in input.
1 | goryBorderRoZsUUUUM
poc_file:1.107: error: Bad character U+0000 in input.
1 | goryBorderRoZsUUUUM
poc_file:1.107: error: Bad character U+0000 in input.
1 | goryBorderRoZsUUUUM
poc_file:1.107-1.108: error: Bad character U+FFFD in input.
1 | goryBorderRoZsUUUUM
poc_file:1.108: error: Bad character U+000E in input.
1 | goryBorderRoZsUUUUM
pspp: src/data/data-out.c:173: data_out_pool: Assertion `fmt_check_output (format)' failed.
******************************************************
You have discovered a bug in PSPP. Please report this
to bug-gnu-pspp@gnu.org. Please include this entire
message, *plus* several lines of output just above it.
For the best chance at having the bug fixed, also
include the syntax file that triggered it and a sample
of any data file used for input.
proximate cause: Assertion Failure/Abort
version: GNU pspp 1.6.2
host_system: x86_64-pc-linux-gnu
build_system: x86_64-pc-linux-gnu
locale_dir: /home/youngseok/latest-subjects/pspp/install_main/share/locale
compiler version: 7.5.0
******************************************************
[1] 1867 abort ./pspp poc_file
Stack Trace
#0 0x00007ffff56d1e87 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
#1 0x00007ffff56d37f1 in __GI_abort () at abort.c:79
#2 0x00007ffff56c33fa in __assert_fail_base (fmt=0x7ffff584a6c0 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x7ffff66eba40 "fmt_check_output (format)", file=file@entry=0x7ffff66eba00 "src/data/data-out.c", line=line@entry=173, function=function@entry=0x7ffff66ec960 <__PRETTY_FUNCTION__.10084> "data_out_pool") at assert.c:92
#3 0x00007ffff56c3472 in __GI___assert_fail (assertion=0x7ffff66eba40 "fmt_check_output (format)", file=0x7ffff66eba00 "src/data/data-out.c", line=173, function=0x7ffff66ec960 <__PRETTY_FUNCTION__.10084> "data_out_pool") at assert.c:101
#4 0x00007ffff656d63a in data_out_pool (input=0x7fffffffda60, input_encoding=0x0, format=..., settings=0x7ffff67ca5d8 <the_settings+120>, pool=0x0) at src/data/data-out.c:173
#5 0x00007ffff656defc in data_out (input=0x7fffffffda60, input_encoding=0x0, format=..., settings=0x7ffff67ca5d8 <the_settings+120>) at src/data/data-out.c:233
#6 0x00007ffff6a3bad3 in matrix_print_text (print=0x60b000005f30, m=0x604000013ed0, format=..., log_scale=0) at src/language/commands/matrix.c:5611
#7 0x00007ffff6a3c496 in matrix_print_execute (print=0x60b000005f30) at src/language/commands/matrix.c:5701
#8 0x00007ffff6a53859 in matrix_command_execute (cmd=0x60b000005f20) at src/language/commands/matrix.c:8837
#9 0x00007ffff6a54df4 in cmd_matrix (lexer=0x603000000370, ds=0x612000000040) at src/language/commands/matrix.c:9134
#10 0x00007ffff690d362 in do_parse_command (lexer=0x603000000370, ds=0x612000000040, state=CMD_STATE_INITIAL) at src/language/command.c:243
#11 0x00007ffff690cd0a in cmd_parse_in_state (lexer=0x603000000370, ds=0x612000000040, state=CMD_STATE_INITIAL) at src/language/command.c:149
#12 0x00007ffff690cdda in cmd_parse (lexer=0x603000000370, ds=0x612000000040) at src/language/command.c:164
#13 0x0000555555559e7b in main (argc=2, argv=0x7fffffffe138) at src/ui/terminal/main.c:139
Environment
OS: Ubuntu 18.04
gcc: 7.5.0
pspp: 1.6.2 (master branch - git commit id 312c1f22e9740afa6b6d2eff88fb49826917f35)
Note that pspp is built with address sanitizer and several options:
CFLAGS="-fsanitize=address -g -O0" CXXFLAGS="-fsanitize=address -g -O0" \
./configure --prefix=`pwd`/install_main --without-perl-module --without-gui
poc_file