GNU PSPP Heap-Based Buffer Overflow Vulnerability in ZIP Reader Functionality

A heap-based buffer overflow vulnerability has been identified in GNU PSPP versions through 2.0.1. The issue arises in the ZIP reader component, specifically within the 'inflate_read' function, which is called indirectly from 'zip_member_read_all' in 'zip-reader.c'. This vulnerability allows attackers to manipulate the ZIP file handling, potentially leading to memory corruption.

Impact

Exploitation of this vulnerability causes a heap-based buffer overflow, which can lead to memory corruption and possibly allow for arbitrary code execution.

Reproduction

The vulnerability can be reproduced by compiling GNU PSPP with AddressSanitizer enabled, using Clang as the compiler. After installing the vulnerable version of PSPP, the issue can be triggered by processing a specially crafted SPSS file that exploits the buffer overflow in the ZIP reader.