Daviesrob

Um problema de escrita e leitura fora dos limites do heap existe na função `bgzf index load hfile()` em `bgzf.c`. Um invasor pode corromper a memória do heap fornecendo uma contagem de entrada de índice .gzi especialmente manipulada. Especificamente, uma contagem de `0xFFFFFFFF` trunca a variável `noffs` para zero, o que leva a escritas além de um buffer `malloc(0)` e a uma leitura `offs[-1]` na função `bgzf useek()`. Isso pode resultar em corrupção de heap ou falhas no sistema em ferramentas associadas, como samtools e bcftools.

HTSlib is a library used for reading and writing bioinformatics file formats. A heap buffer overflow exists in the `cram decode seq()` function when decoding CRAM files. This occurs because the function incorrectly handles records that omit DNA sequence and quality values, leading to a read and write operation beyond the bounds of a heap allocation. Exploitation of this issue, through a crafted CRAM file, could lead to program crashes, data corruption, or potentially arbitrary code execution.

HTSlib is a library used for reading and writing bioinformatics file formats. The issue relates to the CRAM decoder, which has a heap buffer overflow due to improper validation of input data. Specifically, an out-by-one error in a test for CRAM features beyond the extent of the CRAM record sequence can lead to an invalid write of one attacker-controlled byte beyond the end of a heap buffer. Exploitation of this issue could lead to program crashes or overwriting of data and heap structures, potentially resulting in arbitrary code execution.

HTSlib is a library used for reading and writing bioinformatics file formats. A flaw exists in the handling of `VARINT` and `CONST` encodings within the CRAM compressed format. Insufficient validation of the encoding context can lead to heap or stack buffer overflows, potentially allowing for arbitrary code execution. Specifically, up to eight bytes may be written beyond allocated memory regions, potentially overwriting adjacent variables or altering program control flow. Exploitation requires a specially crafted file.