Fix n-squared complexity in sample line with many adjacent tabs #1503
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This could be triggered by a #CHROM line ending in something like: ...\tINFO\t\t\t\t\t\t ... many tabs ... \t\t\tfoo\n Between each pair of tabs, bcf_hdr_add_sample_len() was called with len = 0, as if from bcf_hdr_add_sample(). This made it use strlen(s) instead of 0 as the sample name length, resulting in the addition of a bogus sample name with lots of leading tabs. The sample line parser then moved on to the next tab, and do the same thing again with one fewer leading tab. Fix by making bcf_hdr_add_sample_len() always use the passed-in length, even if 0, allowing the empty sample name trap to do its work. bcf_hdr_add_sample() is updated to call strlen() itself, and to also deal with the backwards-compatibility check where it was permissible to call it with a NULL string. Credit to OSS-Fuzz Fixes oss-fuzz 47641
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This could be triggered by a #CHROM line ending in something like:
Between each pair of tabs,
bcf_hdr_add_sample_len()was called withlen = 0, as if frombcf_hdr_add_sample(). This made it usestrlen(s)instead of 0 as the sample name length, resulting in the addition of a bogus sample name with lots of leading tabs. The sample line parser then moved on to the next tab, and did the same thing again with one fewer leading tab.Fix by making
bcf_hdr_add_sample_len()always use the passed-in length, even if 0, allowing the empty sample name trap to do its work.bcf_hdr_add_sample()is updated to callstrlen()itself, and to also deal with the backwards-compatibility check where it was permissible to call it with a NULL string.