Project: htslib (samtools/htslib), language: c++
Vulnerability instance: htslib.cve-2018-13843
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/samtools/htslib/issues/731#issue-339662537
## Description:
Issue: samtools/htslib#731
Title: A memory leak detected.
State: closed
Created by: fCorleone
Created at: 2018-07-10 01:38:20+00:00

Issue Body:
Sorry for that I didn't reply in my last issue immediately because I had some other stuffs to handle then. Well ,it seems that you have found the SEGV signal and fixed it. I found another problem here ,it is a memory leak issue.
The program I ran is test_bgzf in test directory, the input file is bgziptest.txt.gz in the same directory.
The command line is :./test_bgzf ./bgziptest.txt
The detail information is displayed as :
```
=================================================================
==11095==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 16 byte(s) in 1 object(s) allocated from:
    #0 0x7f7e77d58961 in realloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98961)
    #1 0x425d8e in bgzf_getline /home/mfc_fuzz/htslib/bgzf.c:1800
    #2 0x40b885 in test_bgzf_getline test/test_bgzf.c:691
    #3 0x40c72f in main test/test_bgzf.c:774
    #4 0x7f7e770ad82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

Direct leak of 16 byte(s) in 1 object(s) allocated from:
    #0 0x7f7e77d58961 in realloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98961)
    #1 0x425d8e in bgzf_getline /home/mfc_fuzz/htslib/bgzf.c:1800
    #2 0x40b885 in test_bgzf_getline test/test_bgzf.c:691
    #3 0x40c711 in main test/test_bgzf.c:773
    #4 0x7f7e770ad82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

Direct leak of 16 byte(s) in 1 object(s) allocated from:
    #0 0x7f7e77d58961 in realloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98961)
    #1 0x425d8e in bgzf_getline /home/mfc_fuzz/htslib/bgzf.c:1800
    #2 0x40b885 in test_bgzf_getline test/test_bgzf.c:691
    #3 0x40c74d in main test/test_bgzf.c:775
    #4 0x7f7e770ad82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

```


Comments:
Comment by fCorleone on 2018-07-10 02:02:33+00:00:
Another issue has been found. It's also a memory leak issue. The command line is ./test_realn -i ./ce#5.sam -o out.sam -f faidx.fa
```
=================================================================
==10754==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 40 byte(s) in 1 object(s) allocated from:
    #0 0x7f829603879a in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9879a)
    #1 0x40cb6b in fai_read /home/mfc_fuzz/htslib/faidx.c:358
    #2 0x40ef67 in fai_load3_core /home/mfc_fuzz/htslib/faidx.c:627
    #3 0x40f53f in fai_load3 /home/mfc_fuzz/htslib/faidx.c:667
    #4 0x40f5a2 in fai_load /home/mfc_fuzz/htslib/faidx.c:673
    #5 0x4040e7 in main test/test_realn.c:75
    #6 0x7f829508482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

Indirect leak of 131072 byte(s) in 1 object(s) allocated from:
    #0 0x7f8296038602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
    #1 0x5d523e in bgzf_read_init /home/mfc_fuzz/htslib/bgzf.c:222
    #2 0x5d6717 in bgzf_open /home/mfc_fuzz/htslib/bgzf.c:309
    #3 0x40f0df in fai_load3_core /home/mfc_fuzz/htslib/faidx.c:640
    #4 0x40f53f in fai_load3 /home/mfc_fuzz/htslib/faidx.c:667
    #5 0x40f5a2 in fai_load /home/mfc_fuzz/htslib/faidx.c:673
    #6 0x4040e7 in main test/test_realn.c:75
    #7 0x7f829508482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

Indirect leak of 4096 byte(s) in 1 object(s) allocated from:
    #0 0x7f8296038602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
    #1 0x413d29 in hfile_init /home/mfc_fuzz/htslib/hfile.c:105
    #2 0x4195d8 in hopen_fd /home/mfc_fuzz/htslib/hfile.c:608
    #3 0x41ffbc in hopen /home/mfc_fuzz/htslib/hfile.c:1041
    #4 0x5d66bb in bgzf_open /home/mfc_fuzz/htslib/bgzf.c:308
    #5 0x40f0df in fai_load3_core /home/mfc_fuzz/htslib/faidx.c:640
    #6 0x40f53f in fai_load3 /home/mfc_fuzz/htslib/faidx.c:667
    #7 0x40f5a2 in fai_load /home/mfc_fuzz/htslib/faidx.c:673
    #8 0x4040e7 in main test/test_realn.c:75
    #9 0x7f829508482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

Indirect leak of 256 byte(s) in 1 object(s) allocated from:
    #0 0x7f8296038961 in realloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98961)
    #1 0x407281 in kh_resize_s /home/mfc_fuzz/htslib/faidx.c:51
    #2 0x408cd6 in kh_put_s /home/mfc_fuzz/htslib/faidx.c:51
    #3 0x409df0 in fai_insert_index /home/mfc_fuzz/htslib/faidx.c:74
    #4 0x40cfd2 in fai_read /home/mfc_fuzz/htslib/faidx.c:400
    #5 0x40ef67 in fai_load3_core /home/mfc_fuzz/htslib/faidx.c:627
    #6 0x40f53f in fai_load3 /home/mfc_fuzz/htslib/faidx.c:667
    #7 0x40f5a2 in fai_load /home/mfc_fuzz/htslib/faidx.c:673
    #8 0x4040e7 in main test/test_realn.c:75
    #9 0x7f829508482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

Indirect leak of 128 byte(s) in 1 object(s) allocated from:
    #0 0x7f8296038961 in realloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98961)
    #1 0x40a18a in fai_insert_index /home/mfc_fuzz/htslib/faidx.c:86
    #2 0x40cfd2 in fai_read /home/mfc_fuzz/htslib/faidx.c:400
    #3 0x40ef67 in fai_load3_core /home/mfc_fuzz/htslib/faidx.c:627
    #4 0x40f53f in fai_load3 /home/mfc_fuzz/htslib/faidx.c:667
    #5 0x40f5a2 in fai_load /home/mfc_fuzz/htslib/faidx.c:673
    #6 0x4040e7 in main test/test_realn.c:75
    #7 0x7f829508482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

Indirect leak of 104 byte(s) in 1 object(s) allocated from:
    #0 0x7f829603879a in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9879a)
    #1 0x5d519c in bgzf_read_init /home/mfc_fuzz/htslib/bgzf.c:218
    #2 0x5d6717 in bgzf_open /home/mfc_fuzz/htslib/bgzf.c:309
    #3 0x40f0df in fai_load3_core /home/mfc_fuzz/htslib/faidx.c:640
    #4 0x40f53f in fai_load3 /home/mfc_fuzz/htslib/faidx.c:667
    #5 0x40f5a2 in fai_load /home/mfc_fuzz/htslib/faidx.c:673
    #6 0x4040e7 in main test/test_realn.c:75
    #7 0x7f829508482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

Indirect leak of 64 byte(s) in 1 object(s) allocated from:
    #0 0x7f8296038602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
    #1 0x413cd7 in hfile_init /home/mfc_fuzz/htslib/hfile.c:98
    #2 0x4195d8 in hopen_fd /home/mfc_fuzz/htslib/hfile.c:608
    #3 0x41ffbc in hopen /home/mfc_fuzz/htslib/hfile.c:1041
    #4 0x5d66bb in bgzf_open /home/mfc_fuzz/htslib/bgzf.c:308
    #5 0x40f0df in fai_load3_core /home/mfc_fuzz/htslib/faidx.c:640
    #6 0x40f53f in fai_load3 /home/mfc_fuzz/htslib/faidx.c:667
    #7 0x40f5a2 in fai_load /home/mfc_fuzz/htslib/faidx.c:673
    #8 0x4040e7 in main test/test_realn.c:75
    #9 0x7f829508482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

Indirect leak of 64 byte(s) in 1 object(s) allocated from:
    #0 0x7f8296038961 in realloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98961)
    #1 0x407199 in kh_resize_s /home/mfc_fuzz/htslib/faidx.c:51
    #2 0x408cd6 in kh_put_s /home/mfc_fuzz/htslib/faidx.c:51
    #3 0x409df0 in fai_insert_index /home/mfc_fuzz/htslib/faidx.c:74
    #4 0x40cfd2 in fai_read /home/mfc_fuzz/htslib/faidx.c:400
    #5 0x40ef67 in fai_load3_core /home/mfc_fuzz/htslib/faidx.c:627
    #6 0x40f53f in fai_load3 /home/mfc_fuzz/htslib/faidx.c:667
    #7 0x40f5a2 in fai_load /home/mfc_fuzz/htslib/faidx.c:673
    #8 0x4040e7 in main test/test_realn.c:75
    #9 0x7f829508482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

Indirect leak of 54 byte(s) in 6 object(s) allocated from:
    #0 0x7f829600230f in strdup (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x6230f)
    #1 0x409d66 in fai_insert_index /home/mfc_fuzz/htslib/faidx.c:72
    #2 0x40cfd2 in fai_read /home/mfc_fuzz/htslib/faidx.c:400
    #3 0x40ef67 in fai_load3_core /home/mfc_fuzz/htslib/faidx.c:627
    #4 0x40f53f in fai_load3 /home/mfc_fuzz/htslib/faidx.c:667
    #5 0x40f5a2 in fai_load /home/mfc_fuzz/htslib/faidx.c:673
    #6 0x4040e7 in main test/test_realn.c:75
    #7 0x7f829508482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

Indirect leak of 40 byte(s) in 1 object(s) allocated from:
    #0 0x7f829603879a in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9879a)
    #1 0x406522 in kh_init_s /home/mfc_fuzz/htslib/faidx.c:51
    #2 0x40cbc4 in fai_read /home/mfc_fuzz/htslib/faidx.c:361
    #3 0x40ef67 in fai_load3_core /home/mfc_fuzz/htslib/faidx.c:627
    #4 0x40f53f in fai_load3 /home/mfc_fuzz/htslib/faidx.c:667
    #5 0x40f5a2 in fai_load /home/mfc_fuzz/htslib/faidx.c:673
    #6 0x4040e7 in main test/test_realn.c:75
    #7 0x7f829508482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

Indirect leak of 40 byte(s) in 1 object(s) allocated from:
    #0 0x7f829603879a in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9879a)
    #1 0x5d0c3e in kh_init_cache /home/mfc_fuzz/htslib/bgzf.c:80
    #2 0x5d5653 in bgzf_read_init /home/mfc_fuzz/htslib/bgzf.c:232
    #3 0x5d6717 in bgzf_open /home/mfc_fuzz/htslib/bgzf.c:309
    #4 0x40f0df in fai_load3_core /home/mfc_fuzz/htslib/faidx.c:640
    #5 0x40f53f in fai_load3 /home/mfc_fuzz/htslib/faidx.c:667
    #6 0x40f5a2 in fai_load /home/mfc_fuzz/htslib/faidx.c:673
    #7 0x4040e7 in main test/test_realn.c:75
    #8 0x7f829508482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

Indirect leak of 16 byte(s) in 1 object(s) allocated from:
    #0 0x7f8296038602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
    #1 0x5d5513 in bgzf_read_init /home/mfc_fuzz/htslib/bgzf.c:228
    #2 0x5d6717 in bgzf_open /home/mfc_fuzz/htslib/bgzf.c:309
    #3 0x40f0df in fai_load3_core /home/mfc_fuzz/htslib/faidx.c:640
    #4 0x40f53f in fai_load3 /home/mfc_fuzz/htslib/faidx.c:667
    #5 0x40f5a2 in fai_load /home/mfc_fuzz/htslib/faidx.c:673
    #6 0x4040e7 in main test/test_realn.c:75
    #7 0x7f829508482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

Indirect leak of 4 byte(s) in 1 object(s) allocated from:
    #0 0x7f8296038602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
    #1 0x407009 in kh_resize_s /home/mfc_fuzz/htslib/faidx.c:51
    #2 0x408cd6 in kh_put_s /home/mfc_fuzz/htslib/faidx.c:51
    #3 0x409df0 in fai_insert_index /home/mfc_fuzz/htslib/faidx.c:74
    #4 0x40cfd2 in fai_read /home/mfc_fuzz/htslib/faidx.c:400
    #5 0x40ef67 in fai_load3_core /home/mfc_fuzz/htslib/faidx.c:627
    #6 0x40f53f in fai_load3 /home/mfc_fuzz/htslib/faidx.c:667
    #7 0x40f5a2 in fai_load /home/mfc_fuzz/htslib/faidx.c:673
    #8 0x4040e7 in main test/test_realn.c:75
    #9 0x7f829508482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY: AddressSanitizer: 135978 byte(s) leaked in 18 allocation(s).

```


---

Comment by fCorleone on 2018-07-10 02:39:53+00:00:
And there is a buffer overflow issue found as well.
The input file has been put at: https://github.com/fCorleone/fuzz_programs/blob/master/htslib/testcase1
The command line is : ./test_realn -I testcase1 -o out.sam -f faidx.fa
```
=================================================================
==18692==ERROR: AddressSanitizer: global-buffer-overflow on address 0x00000061f903 at pc 0x0000004845cb bp 0x7ffc4fd5bd50 sp 0x7ffc4fd5bd40
READ of size 1 at 0x00000061f903 thread T0
    #0 0x4845ca in sam_parse1 /home/mfc_fuzz/htslib/sam.c:1303
    #1 0x4878b6 in sam_read1 /home/mfc_fuzz/htslib/sam.c:1459
    #2 0x404dfe in main test/test_realn.c:111
    #3 0x7fb21be2482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #4 0x403958 in _start (/home/mfc_fuzz/htslib/test/test_realn+0x403958)

0x00000061f903 is located 61 bytes to the left of global variable '*.LC4' defined in 'hts.c' (0x61f940) of size 22
  '*.LC4' is ascii string '1.8-40-g98efde4-dirty'
0x00000061f903 is located 27 bytes to the right of global variable '__ac_HASH_UPPER' defined in './htslib/khash.h:192:21' (0x61f8e0) of size 8
SUMMARY: AddressSanitizer: global-buffer-overflow /home/mfc_fuzz/htslib/sam.c:1303 sam_parse1
Shadow bytes around the buggy address:
  0x0000800bbed0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000800bbee0: 00 00 00 00 00 f9 f9 f9 f9 f9 f9 f9 00 01 f9 f9
  0x0000800bbef0: f9 f9 f9 f9 05 f9 f9 f9 f9 f9 f9 f9 04 f9 f9 f9
  0x0000800bbf00: f9 f9 f9 f9 00 00 00 00 00 f9 f9 f9 f9 f9 f9 f9
  0x0000800bbf10: 00 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9
=>0x0000800bbf20:[f9]f9 f9 f9 00 00 00 00 00 00 06 f9 f9 f9 f9 f9
  0x0000800bbf30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000800bbf40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000800bbf50: f9 f9 f9 f9 00 00 01 f9 f9 f9 f9 f9 00 00 00 00
  0x0000800bbf60: 00 00 00 00 f9 f9 f9 f9 00 00 00 00 06 f9 f9 f9
  0x0000800bbf70: f9 f9 f9 f9 00 00 00 00 05 f9 f9 f9 f9 f9 f9 f9
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
==18692==ABORTING

```

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./configure
make -j$(nproc) libhts.a test/fuzz/hts_open_fuzzer.o

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make autoconf automake zlib1g-dev libbz2-dev liblzma-dev libcurl4-gnutls-dev libssl-dev
RUN git clone https://github.com/samtools/htslib htslib
RUN git -C htslib checkout be22a2a1082f6e570718439b9ace2db17a609eae
WORKDIR $SRC/htslib
COPY build.sh $SRC/

Additional files: