Bug#880999: gnuplot: Segfault with false formatted command input

[Malte Marwedel]

Package: gnuplot
Version: 5.0.5+dfsg1-6+deb9u1
Severity: normal

Dear Maintainer,

   * What led up to the situation?

A list of false formatted input, entered with a pipe

   * What exactly did you do (or not do) that was effective (or
     ineffective)?

1. File BadCommand.txt context:
set output "temperatures.svg";\
set terminal svg size 1280,768 dynamic name "Temperatures ";\
set timefmt "%Y-%m-%d %H:%M:%S";\
set xtics format "%d.%m.%Y";
plot "./data.txt" using 1:3 with lines ls 1 title "[°C]" axis x1y1;\

2. File data.txt context:
2016-09-19 20:00:00 24.5

3. Enter Commands with a pipe
cat BadCommand.txt | gnuplot

Anything of the following does *not* the crash:
A: Removing the space in "Temperatures "
B: Adding a backslash \ behind set xtichs line
C: Removing the <title "[°C]">
D: Calling gnuplot BadCommand.txt
E: 1. "pipe foo"; 2. gdb gnuplot; 3. run < foo; 4. cat BadCommand.txt > foo

   * What was the outcome of this action?
Error messages and then
gnuplot[11021]: segfault at 0 ip 00007f84d6a1df2e sp 00007fff75f4fa20 error 4
in libc-2.24.so[7f84d699b000+195000]
gnuplot[11026]: segfault at 0 ip 00007fe9f9c3ef2e sp 00007ffcddc30dd0 error 4
in libc-2.24.so[7fe9f9bbc000+195000]
gnuplot[11029]: segfault at 0 ip 00007fd1395f3f2e sp 00007ffd794ef370 error 4
in libc-2.24.so[7fd139571000+195000]
in dmesg.

   * What outcome did you expect instead?
Just error messages.




-- System Information:
Debian Release: 9.1
  APT prefers stable
  APT policy: (500, 'stable'), (500, 'oldstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.13.2 (SMP w/12 CPU cores)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Init: sysvinit (via /sbin/init)

Versions of packages gnuplot depends on:
ii  gnuplot-qt [gnuplot-nox]  5.0.5+dfsg1-6+deb9u1

gnuplot recommends no packages.

Versions of packages gnuplot suggests:
pn  gnuplot-doc  <none>

-- no debconf information