Skip to content

1.22.3

Choose a tag to compare

View all tags
@daviesrob daviesrob released this 09 Jul 14:57
· 189 commits to develop since this release
1.22.3
This tag was signed with the committer’s verified signature.
daviesrob
GPG key ID: 1ECBE5BA15C64CCC
Verified
Learn about vigilant mode.
22ef718

Download the source code here: htslib-1.22.3.tar.bz2.(The "Source code" downloads are generated by GitHub and are incomplete as they are missing some generated files.)

Bug fixes

  • Better enforce QNAME length restrictions in the CRAM reader. HTSlib limits the length of QNAMEs (and mate QNAMEs) to 254 characters to match the maximum allowed by the BAM format. To avoid problems with handling very long names, enforcement of this limit has been moved to an earlier stage in the CRAM decoder.
    (PR #2046. Reported by Claude and Ada Logics.
    GHSA-2jx2-wm7f-rv9m)

  • Fix incorrect block pointer caching in CRAM v4 xpack and xrle codecs.
    (Commits d66a77d, c0b5037. Reported by Trail of Bits and Anthropic.
    GHSA-6q7c-m967-9v37)

  • Several undefined behaviour fixes co-authored with Team Atlanta.

    • Missing checks that xpack and xrle codecs have enough input data.
    • Possible integer overflows when checking input size for beta, xpack and xrle codecs.
    • Some errors were incorrectly ignored in the xdelta, xpack and xrle codecs.
    • Divide-by-zeros in cram_xpack_decode_char and cram_xdelta_decode.
    • Oversized shift in cram_subexp_decode.

(PR #2025, #2026, #2046; commits 2645b7c to ad5b852. Reported by Team Atlanta.
GHSA-rjqv-xg3q-g423
GHSA-hg3g-v57p-459q)

  • Bounds-check refid when loading a CRAM .crai index.
    (PR #2029. Thanks to Sidhartha Kumar.
    GHSA-28r7-prwc-hf5c)

  • Improve checks of record consitency in the BCF reader, and disallow excessively large FORMAT entries.
    (PR #2047. Reported by VulnSeeker Security Research.
    GHSA-2wm6-8hgm-7g92)

  • Improve validation of faidx index entries.
    (PR #2008.
    GHSA-4hjq-r829-8c8v)

  • Protect against uninitialised variable read with CRAM X_NOSZ codecs. (PR #2023, fixes #2021. Reported by Jiami Lin)

  • Fix a possible crash when using nonsensical embed_ref=2,no_ref CRAM encode options. (PR #2048)

  • Bug fix CRAM v4 CRAM_FLAG_EXPLICIT_TLEN option. (PR #1993)

  • Remove a signed overflow bug in bgzf_read_small. (PR #2013)

  • Improve SQ LN field checking. (PR #1999)

  • Fix problem that caused hfile_libcurl to fail on platforms that disable ftp in their libcurl builds. (PR #2041)

  • Small updates to fix misplaced NULL checks, remove unused variables, and ensure the package builds without warnings on newer compilers. (PR #1992, #2004, #2028)

  • In bgzip and tabix, when handling errors, don't try to access the BGZF::errcode field after calling bgzf_close() as it may no longer be valid. (PR #2035, #2042)

  • Fix some memory leaks on failing to build or load an index (PR #2049)

Build Changes

  • The htscodecs submodule is updated to v1.6.7. (PR #2040)

Download the source code here: htslib-1.22.3.tar.bz2.(The "Source code" downloads are generated by GitHub and are incomplete as they are missing some generated files.)

Assets 3
Loading