Project: htslib (samtools/htslib), language: c++
Vulnerability instance: htslib.cve-2018-13844
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/samtools/htslib/issues/731#issuecomment-403675330
## Description:
Issue: samtools/htslib#731
Title: A memory leak detected.
Referenced comment by fCorleone on 2018-07-10 02:02:33+00:00:

Another issue has been found. It's also a memory leak issue. The command line is ./test_realn -i ./ce#5.sam -o out.sam -f faidx.fa
```
=================================================================
==10754==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 40 byte(s) in 1 object(s) allocated from:
    #0 0x7f829603879a in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9879a)
    #1 0x40cb6b in fai_read /home/mfc_fuzz/htslib/faidx.c:358
    #2 0x40ef67 in fai_load3_core /home/mfc_fuzz/htslib/faidx.c:627
    #3 0x40f53f in fai_load3 /home/mfc_fuzz/htslib/faidx.c:667
    #4 0x40f5a2 in fai_load /home/mfc_fuzz/htslib/faidx.c:673
    #5 0x4040e7 in main test/test_realn.c:75
    #6 0x7f829508482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

Indirect leak of 131072 byte(s) in 1 object(s) allocated from:
    #0 0x7f8296038602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
    #1 0x5d523e in bgzf_read_init /home/mfc_fuzz/htslib/bgzf.c:222
    #2 0x5d6717 in bgzf_open /home/mfc_fuzz/htslib/bgzf.c:309
    #3 0x40f0df in fai_load3_core /home/mfc_fuzz/htslib/faidx.c:640
    #4 0x40f53f in fai_load3 /home/mfc_fuzz/htslib/faidx.c:667
    #5 0x40f5a2 in fai_load /home/mfc_fuzz/htslib/faidx.c:673
    #6 0x4040e7 in main test/test_realn.c:75
    #7 0x7f829508482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

Indirect leak of 4096 byte(s) in 1 object(s) allocated from:
    #0 0x7f8296038602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
    #1 0x413d29 in hfile_init /home/mfc_fuzz/htslib/hfile.c:105
    #2 0x4195d8 in hopen_fd /home/mfc_fuzz/htslib/hfile.c:608
    #3 0x41ffbc in hopen /home/mfc_fuzz/htslib/hfile.c:1041
    #4 0x5d66bb in bgzf_open /home/mfc_fuzz/htslib/bgzf.c:308
    #5 0x40f0df in fai_load3_core /home/mfc_fuzz/htslib/faidx.c:640
    #6 0x40f53f in fai_load3 /home/mfc_fuzz/htslib/faidx.c:667
    #7 0x40f5a2 in fai_load /home/mfc_fuzz/htslib/faidx.c:673
    #8 0x4040e7 in main test/test_realn.c:75
    #9 0x7f829508482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

Indirect leak of 256 byte(s) in 1 object(s) allocated from:
    #0 0x7f8296038961 in realloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98961)
    #1 0x407281 in kh_resize_s /home/mfc_fuzz/htslib/faidx.c:51
    #2 0x408cd6 in kh_put_s /home/mfc_fuzz/htslib/faidx.c:51
    #3 0x409df0 in fai_insert_index /home/mfc_fuzz/htslib/faidx.c:74
    #4 0x40cfd2 in fai_read /home/mfc_fuzz/htslib/faidx.c:400
    #5 0x40ef67 in fai_load3_core /home/mfc_fuzz/htslib/faidx.c:627
    #6 0x40f53f in fai_load3 /home/mfc_fuzz/htslib/faidx.c:667
    #7 0x40f5a2 in fai_load /home/mfc_fuzz/htslib/faidx.c:673
    #8 0x4040e7 in main test/test_realn.c:75
    #9 0x7f829508482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

Indirect leak of 128 byte(s) in 1 object(s) allocated from:
    #0 0x7f8296038961 in realloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98961)
    #1 0x40a18a in fai_insert_index /home/mfc_fuzz/htslib/faidx.c:86
    #2 0x40cfd2 in fai_read /home/mfc_fuzz/htslib/faidx.c:400
    #3 0x40ef67 in fai_load3_core /home/mfc_fuzz/htslib/faidx.c:627
    #4 0x40f53f in fai_load3 /home/mfc_fuzz/htslib/faidx.c:667
    #5 0x40f5a2 in fai_load /home/mfc_fuzz/htslib/faidx.c:673
    #6 0x4040e7 in main test/test_realn.c:75
    #7 0x7f829508482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

Indirect leak of 104 byte(s) in 1 object(s) allocated from:
    #0 0x7f829603879a in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9879a)
    #1 0x5d519c in bgzf_read_init /home/mfc_fuzz/htslib/bgzf.c:218
    #2 0x5d6717 in bgzf_open /home/mfc_fuzz/htslib/bgzf.c:309
    #3 0x40f0df in fai_load3_core /home/mfc_fuzz/htslib/faidx.c:640
    #4 0x40f53f in fai_load3 /home/mfc_fuzz/htslib/faidx.c:667
    #5 0x40f5a2 in fai_load /home/mfc_fuzz/htslib/faidx.c:673
    #6 0x4040e7 in main test/test_realn.c:75
    #7 0x7f829508482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

Indirect leak of 64 byte(s) in 1 object(s) allocated from:
    #0 0x7f8296038602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
    #1 0x413cd7 in hfile_init /home/mfc_fuzz/htslib/hfile.c:98
    #2 0x4195d8 in hopen_fd /home/mfc_fuzz/htslib/hfile.c:608
    #3 0x41ffbc in hopen /home/mfc_fuzz/htslib/hfile.c:1041
    #4 0x5d66bb in bgzf_open /home/mfc_fuzz/htslib/bgzf.c:308
    #5 0x40f0df in fai_load3_core /home/mfc_fuzz/htslib/faidx.c:640
    #6 0x40f53f in fai_load3 /home/mfc_fuzz/htslib/faidx.c:667
    #7 0x40f5a2 in fai_load /home/mfc_fuzz/htslib/faidx.c:673
    #8 0x4040e7 in main test/test_realn.c:75
    #9 0x7f829508482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

Indirect leak of 64 byte(s) in 1 object(s) allocated from:
    #0 0x7f8296038961 in realloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98961)
    #1 0x407199 in kh_resize_s /home/mfc_fuzz/htslib/faidx.c:51
    #2 0x408cd6 in kh_put_s /home/mfc_fuzz/htslib/faidx.c:51
    #3 0x409df0 in fai_insert_index /home/mfc_fuzz/htslib/faidx.c:74
    #4 0x40cfd2 in fai_read /home/mfc_fuzz/htslib/faidx.c:400
    #5 0x40ef67 in fai_load3_core /home/mfc_fuzz/htslib/faidx.c:627
    #6 0x40f53f in fai_load3 /home/mfc_fuzz/htslib/faidx.c:667
    #7 0x40f5a2 in fai_load /home/mfc_fuzz/htslib/faidx.c:673
    #8 0x4040e7 in main test/test_realn.c:75
    #9 0x7f829508482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

Indirect leak of 54 byte(s) in 6 object(s) allocated from:
    #0 0x7f829600230f in strdup (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x6230f)
    #1 0x409d66 in fai_insert_index /home/mfc_fuzz/htslib/faidx.c:72
    #2 0x40cfd2 in fai_read /home/mfc_fuzz/htslib/faidx.c:400
    #3 0x40ef67 in fai_load3_core /home/mfc_fuzz/htslib/faidx.c:627
    #4 0x40f53f in fai_load3 /home/mfc_fuzz/htslib/faidx.c:667
    #5 0x40f5a2 in fai_load /home/mfc_fuzz/htslib/faidx.c:673
    #6 0x4040e7 in main test/test_realn.c:75
    #7 0x7f829508482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

Indirect leak of 40 byte(s) in 1 object(s) allocated from:
    #0 0x7f829603879a in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9879a)
    #1 0x406522 in kh_init_s /home/mfc_fuzz/htslib/faidx.c:51
    #2 0x40cbc4 in fai_read /home/mfc_fuzz/htslib/faidx.c:361
    #3 0x40ef67 in fai_load3_core /home/mfc_fuzz/htslib/faidx.c:627
    #4 0x40f53f in fai_load3 /home/mfc_fuzz/htslib/faidx.c:667
    #5 0x40f5a2 in fai_load /home/mfc_fuzz/htslib/faidx.c:673
    #6 0x4040e7 in main test/test_realn.c:75
    #7 0x7f829508482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

Indirect leak of 40 byte(s) in 1 object(s) allocated from:
    #0 0x7f829603879a in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9879a)
    #1 0x5d0c3e in kh_init_cache /home/mfc_fuzz/htslib/bgzf.c:80
    #2 0x5d5653 in bgzf_read_init /home/mfc_fuzz/htslib/bgzf.c:232
    #3 0x5d6717 in bgzf_open /home/mfc_fuzz/htslib/bgzf.c:309
    #4 0x40f0df in fai_load3_core /home/mfc_fuzz/htslib/faidx.c:640
    #5 0x40f53f in fai_load3 /home/mfc_fuzz/htslib/faidx.c:667
    #6 0x40f5a2 in fai_load /home/mfc_fuzz/htslib/faidx.c:673
    #7 0x4040e7 in main test/test_realn.c:75
    #8 0x7f829508482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

Indirect leak of 16 byte(s) in 1 object(s) allocated from:
    #0 0x7f8296038602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
    #1 0x5d5513 in bgzf_read_init /home/mfc_fuzz/htslib/bgzf.c:228
    #2 0x5d6717 in bgzf_open /home/mfc_fuzz/htslib/bgzf.c:309
    #3 0x40f0df in fai_load3_core /home/mfc_fuzz/htslib/faidx.c:640
    #4 0x40f53f in fai_load3 /home/mfc_fuzz/htslib/faidx.c:667
    #5 0x40f5a2 in fai_load /home/mfc_fuzz/htslib/faidx.c:673
    #6 0x4040e7 in main test/test_realn.c:75
    #7 0x7f829508482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

Indirect leak of 4 byte(s) in 1 object(s) allocated from:
    #0 0x7f8296038602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
    #1 0x407009 in kh_resize_s /home/mfc_fuzz/htslib/faidx.c:51
    #2 0x408cd6 in kh_put_s /home/mfc_fuzz/htslib/faidx.c:51
    #3 0x409df0 in fai_insert_index /home/mfc_fuzz/htslib/faidx.c:74
    #4 0x40cfd2 in fai_read /home/mfc_fuzz/htslib/faidx.c:400
    #5 0x40ef67 in fai_load3_core /home/mfc_fuzz/htslib/faidx.c:627
    #6 0x40f53f in fai_load3 /home/mfc_fuzz/htslib/faidx.c:667
    #7 0x40f5a2 in fai_load /home/mfc_fuzz/htslib/faidx.c:673
    #8 0x4040e7 in main test/test_realn.c:75
    #9 0x7f829508482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY: AddressSanitizer: 135978 byte(s) leaked in 18 allocation(s).

```


Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./configure
make -j$(nproc) libhts.a test/fuzz/hts_open_fuzzer.o

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make autoconf automake zlib1g-dev libbz2-dev liblzma-dev libcurl4-gnutls-dev libssl-dev
RUN git clone https://github.com/samtools/htslib htslib
RUN git -C htslib checkout be22a2a1082f6e570718439b9ace2db17a609eae
WORKDIR $SRC/htslib
COPY build.sh $SRC/

Additional files: