Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix @PG linking when records make a loop #1702

Merged
merged 1 commit into from
Nov 23, 2023

Conversation

daviesrob
Copy link
Member

If all the @PG records passed to sam_hdr_link_pg() form a single PP loop, all entries in the sam_hrecs_t::pg_end array it builds get set to -1, indicating that there are no chain start points. These entries are then removed to make the final list, but due to a bug in handling the case where there are no PP links the number of entries was incorrectly set to 1 instead of 0. This could lead to an out-of-bounds read in sam_hdr_add_pg() when linking new @PG entries to the existing ones.

Fix by ensuring that only valid end points are returned in the sam_hrecs_t::pg_end array, and the length is set to zero if no ends are detected due to a loop.

Adds a warning if a @PG record is found with a PP link to itself. Detecting longer loops is left for future work. Fixes another warning which incorrectly said 'SN' instead of 'ID' in its message.

Adds an assert() in sam_hdr_add_pg() to catch any other cases of the out-of-bounds read.

Adds tests for loopy @PG records.

Thanks to @OctavioGalland for the bug report. Fixes #1694

If all the @pg records passed to sam_hdr_link_pg() form a single
PP loop, all entries in the sam_hrecs_t::pg_end array it builds
get set to -1, indicating that there are no chain start points.
These entries are then removed to make the final list, but
due to a bug in handling the case where there are no PP links
the number of entries was incorrectly set to 1 instead of 0. This
could lead to an out-of-bounds read in sam_hdr_add_pg() when
linking new @pg entries to the existing ones.

Fix by ensuring that only valid end points are returned in the
sam_hrecs_t::pg_end array, and the length is set to zero if
no ends are detected due to a loop.

Adds a warning if a @pg record is found with a PP link to itself.
Detecting longer loops is left for future work.  Fixes another
warning which incorrectly said 'SN' instead of 'ID' in its message.

Adds an assert() in sam_hdr_add_pg() to catch any other cases of
the out-of-bounds read.

Adds tests for loopy @pg records.

Thanks to Octavio Galland for the bug report.
@whitwham whitwham merged commit db16b32 into samtools:develop Nov 23, 2023
8 checks passed
@daviesrob daviesrob deleted the self_pp branch November 23, 2023 15:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Heap overflow during sam_hdr_add_pg
2 participants