Skip to content

Commit

Permalink
Fix integer overflow in cram_compress_block2
Browse files Browse the repository at this point in the history
The figure used here is somewhat arbitrary as it's simply a marker for
something considerably worse than no compression, given it's used in
places where the compression wasn't applied or fails.  Although sz is
long, it may get other modifiers and the CRAM block size is int so
UINT_MAX seems like a natural "larger than possible" value to use.

Credit to OSS-Fuzz
Fixes oss-fuzz 64616
  • Loading branch information
jkbonfield authored and daviesrob committed Dec 4, 2023
1 parent 3827169 commit 8db4cfa
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions cram/cram_io.c
Original file line number Diff line number Diff line change
Expand Up @@ -2079,10 +2079,10 @@ int cram_compress_block2(cram_fd *fd, cram_slice *s,
} else if (c) {
free(c);
} else {
sz[m] = b->uncomp_size*2+1000; // arbitrarily worse than raw
sz[m] = UINT_MAX; // arbitrarily worse than raw
}
} else {
sz[m] = b->uncomp_size*2+1000; // arbitrarily worse than raw
sz[m] = UINT_MAX; // arbitrarily worse than raw
}
}

Expand Down

0 comments on commit 8db4cfa

Please sign in to comment.