Avoid undefined behaviour integer overflow in extend_ref

Credit to OSS-Fuzz Fixes oss-fuzz 64646
samtools · Dec 4, 2023 · 3827169 · 3827169
1 parent 927ed61
commit 3827169
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/cram/cram_encode.c b/cram/cram_encode.c
@@ -1509,6 +1509,9 @@ static inline int extend_ref(char **ref, uint32_t (**hist)[5], hts_pos_t pos,
         return 0;
 
     // realloc
+    if (pos - ref_start > UINT_MAX)
+        return -2; // protect overflow in new_end calculation
+
     hts_pos_t old_end = *ref_end ? *ref_end : ref_start;
     hts_pos_t new_end = ref_start + 1000 + (pos-ref_start)*1.5;