Daviesrob

A heap out-of-bounds write and read issue exists in the `bgzf index load hfile()` function within `bgzf.c`. An attacker can corrupt heap memory by providing a specially crafted .gzi index entry count. Specifically, a count of `0xFFFFFFFF` truncates the `noffs` variable to zero, which leads to writes beyond a `malloc(0)` buffer and an `offs[-1]` read in the `bgzf useek()` function. This can result in heap corruption or system crashes in associated tools such as samtools and bcftools.

HTSlib is a library used for reading and writing bioinformatics file formats. A heap buffer overflow exists in the `cram decode seq()` function when decoding CRAM files. This occurs because the function incorrectly handles records that omit DNA sequence and quality values, leading to a read and write operation beyond the bounds of a heap allocation. Exploitation of this issue, through a crafted CRAM file, could lead to program crashes, data corruption, or potentially arbitrary code execution.

HTSlib is a library used for reading and writing bioinformatics file formats. The issue relates to the CRAM decoder, which has a heap buffer overflow due to improper validation of input data. Specifically, an out-by-one error in a test for CRAM features beyond the extent of the CRAM record sequence can lead to an invalid write of one attacker-controlled byte beyond the end of a heap buffer. Exploitation of this issue could lead to program crashes or overwriting of data and heap structures, potentially resulting in arbitrary code execution.

HTSlib is a library used for reading and writing bioinformatics file formats. A flaw exists in the handling of `VARINT` and `CONST` encodings within the CRAM compressed format. Insufficient validation of the encoding context can lead to heap or stack buffer overflows, potentially allowing for arbitrary code execution. Specifically, up to eight bytes may be written beyond allocated memory regions, potentially overwriting adjacent variables or altering program control flow. Exploitation requires a specially crafted file.