Segmentation fault in bwamem.c

[ihaque]

The attached testcases were generated by fuzzing BWA-MEM using American Fuzzy Lop. They're massively invalid FASTQ but reliably trigger segfaults at bwamem.c:878 when attempting to align against an E. coli genome:

ihaque@frontend001:~/afl-fuzz$ gdb --args ./bwa-debug mem Escherichia_coli_str_k_12_substr_mg1655.ASM584v2.dna.chromosome.Chromosome.fa.gz crash1.min.fastq
GNU gdb (Ubuntu 7.11.1-0ubuntu1~16.04) 7.11.1
Copyright (C) 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ./bwa-debug...done.
(gdb) run
Starting program: /home/ihaque/afl-fuzz/bwa-debug mem Escherichia_coli_str_k_12_substr_mg1655.ASM584v2.dna.chromosome.Chromosome.fa.gz crash1.min.fastq
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[M::bwa_idx_load_from_disk] read 0 ALT contigs
@SQ     SN:Chromosome   LN:4641652
@PG     ID:bwa  PN:bwa  VN:0.7.15-r1140 CL:/home/ihaque/afl-fuzz/bwa-debug mem Escherichia_coli_str_k_12_substr_mg1655.ASM584v2.dna.chromosome.Chromosome.fa.gz crash1.min.fastq
[New Thread 0x7ffff6a20700 (LWP 15512)]
[M::process] read 1 sequences (25971 bp)...
[New Thread 0x7ffff621f700 (LWP 15516)]
[New Thread 0x7ffff5a1e700 (LWP 15518)]
[Thread 0x7ffff5a1e700 (LWP 15518) exited]
[Thread 0x7ffff621f700 (LWP 15516) exited]
[New Thread 0x7ffff5a1e700 (LWP 15520)]

Thread 5 "bwa-debug" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7ffff5a1e700 (LWP 15520)]
0x000000000043a00a in mem_aln2sam (opt=opt@entry=0x658120, bns=bns@entry=0x6587a0, str=str@entry=0x7ffff5a1de60, s=s@entry=0x7ffff0018540, n=n@entry=1, list=list@entry=0x7ffff5a1de80, which=0, m_=0x0)
    at bwamem.c:878
878                             for (i = qb; i < qe; ++i) str->s[str->l++] = s->qual[i];