Skip to content

Fix regidx out-of-bounds array access and double free #2533

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pd3 merged 1 commit into from
Mar 31, 2026
+2 −1
Merged

Fix regidx out-of-bounds array access and double free #2533

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion regidx.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -289,6 +289,7 @@ regidx_t *regidx_init(const char *fname, regidx_parse_f parser, regidx_free_f fr
}

free(str.s);
str.s = NULL;
if ( hts_close(fp)!=0 )
{
fprintf(stderr,"[%s] Error: close failed .. %s\n", __func__,fname);
Expand Down Expand Up @@ -441,7 +442,7 @@ int regidx_overlap(regidx_t *regidx, const char *chr, uint32_t beg, uint32_t end
if ( !i )
{
int iend = iBIN(end);
if ( iend > list->nidx ) iend = list->nidx;
if ( iend >= list->nidx ) iend = list->nidx - 1;
Copy link
Copy Markdown
Member

@pd3 pd3 Mar 31, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@daviesrob If correct, I think this affects also regidx.c code in htslib

Copy link
Copy Markdown
Member

@daviesrob daviesrob Apr 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not convinced that this is correct. The item count gets incremented by 1 when allocating list->idx, so it can accommodate looking up iend. I assume that it was written that way because the actual range is likely to end somewhere in the middle of the bin.

Because the array is big enough, there is no out of bounds access.

for (i=ibeg; i<=iend; i++)
if ( list->idx[i] ) break;
if ( i>iend ) return 0;
Expand Down