Skip to content

Commit

Permalink
fix fuzz integer overflow in cram encoder.
Browse files Browse the repository at this point in the history
Input files with very long CIGAR strings and consensus generated
embedded reference can lead to exceptionally long CRAM blocks which
overflow the check for large size fluctuations (to trigger new
compression metric assessments).

Reformulated the expression to avoid scaling up values.

Credit to OSS-Fuzz
Fixes oss-fuzz 68225
  • Loading branch information
jkbonfield authored and daviesrob committed May 2, 2024
1 parent c93f5a5 commit 1e7efc0
Showing 1 changed file with 8 additions and 4 deletions.
12 changes: 8 additions & 4 deletions cram/cram_io.c
Original file line number Diff line number Diff line change
Expand Up @@ -1984,11 +1984,15 @@ int cram_compress_block2(cram_fd *fd, cram_slice *s,
// We also get large fluctuations based on genome coordinate for
// e.g. SA:Z and SC series, but we consider the typical scale of
// delta between blocks and use this to look for abnormality.

// Equivalent to (but minus possible integer overflow)
// (b->uncomp_size + 1000)/4 > metrics->input_avg_sz+1000 ||
// b->uncomp_size + 1000 < (metrics->input_avg_sz+1000)/4)
if (metrics->input_avg_sz &&
(b->uncomp_size + 1000 > 4*(metrics->input_avg_sz+1000) ||
b->uncomp_size + 1000 < (metrics->input_avg_sz+1000)/4) &&
ABS(b->uncomp_size-metrics->input_avg_sz)
> 10*metrics->input_avg_delta) {
(b->uncomp_size/4 - 750 > metrics->input_avg_sz ||
b->uncomp_size < metrics->input_avg_sz/4 - 750) &&
ABS(b->uncomp_size-metrics->input_avg_sz)/10
> metrics->input_avg_delta) {
metrics->next_trial = 0;
}

Expand Down

0 comments on commit 1e7efc0

Please sign in to comment.