Project: htslib (samtools/htslib), language: c++
Vulnerability instance: htslib.cve-2018-13845
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/samtools/htslib/issues/731#issuecomment-403681105
## Description:
Issue: samtools/htslib#731
Title: A memory leak detected.
Referenced comment by fCorleone on 2018-07-10 02:39:53+00:00:

And there is a buffer overflow issue found as well.
The input file has been put at: https://github.com/fCorleone/fuzz_programs/blob/master/htslib/testcase1
The command line is : ./test_realn -I testcase1 -o out.sam -f faidx.fa
```
=================================================================
==18692==ERROR: AddressSanitizer: global-buffer-overflow on address 0x00000061f903 at pc 0x0000004845cb bp 0x7ffc4fd5bd50 sp 0x7ffc4fd5bd40
READ of size 1 at 0x00000061f903 thread T0
    #0 0x4845ca in sam_parse1 /home/mfc_fuzz/htslib/sam.c:1303
    #1 0x4878b6 in sam_read1 /home/mfc_fuzz/htslib/sam.c:1459
    #2 0x404dfe in main test/test_realn.c:111
    #3 0x7fb21be2482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #4 0x403958 in _start (/home/mfc_fuzz/htslib/test/test_realn+0x403958)

0x00000061f903 is located 61 bytes to the left of global variable '*.LC4' defined in 'hts.c' (0x61f940) of size 22
  '*.LC4' is ascii string '1.8-40-g98efde4-dirty'
0x00000061f903 is located 27 bytes to the right of global variable '__ac_HASH_UPPER' defined in './htslib/khash.h:192:21' (0x61f8e0) of size 8
SUMMARY: AddressSanitizer: global-buffer-overflow /home/mfc_fuzz/htslib/sam.c:1303 sam_parse1
Shadow bytes around the buggy address:
  0x0000800bbed0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000800bbee0: 00 00 00 00 00 f9 f9 f9 f9 f9 f9 f9 00 01 f9 f9
  0x0000800bbef0: f9 f9 f9 f9 05 f9 f9 f9 f9 f9 f9 f9 04 f9 f9 f9
  0x0000800bbf00: f9 f9 f9 f9 00 00 00 00 00 f9 f9 f9 f9 f9 f9 f9
  0x0000800bbf10: 00 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9
=>0x0000800bbf20:[f9]f9 f9 f9 00 00 00 00 00 00 06 f9 f9 f9 f9 f9
  0x0000800bbf30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000800bbf40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000800bbf50: f9 f9 f9 f9 00 00 01 f9 f9 f9 f9 f9 00 00 00 00
  0x0000800bbf60: 00 00 00 00 f9 f9 f9 f9 00 00 00 00 06 f9 f9 f9
  0x0000800bbf70: f9 f9 f9 f9 00 00 00 00 05 f9 f9 f9 f9 f9 f9 f9
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
==18692==ABORTING

```

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./configure
make -j$(nproc) libhts.a test/fuzz/hts_open_fuzzer.o

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make autoconf automake zlib1g-dev libbz2-dev liblzma-dev libcurl4-gnutls-dev libssl-dev
RUN git clone https://github.com/samtools/htslib htslib
RUN git -C htslib checkout be22a2a1082f6e570718439b9ace2db17a609eae
WORKDIR $SRC/htslib
COPY build.sh $SRC/

Additional files: