Bound the cache-index (.ndx) parser to its buffer - #507
Merged
Conversation
cache_brstr trusted the on-disk length prefix for its cursor advance (off += i, i up to 32768), so a corrupt or truncated hts-cache/*.ndx whose declared length overstates the file walked the length-prefixed scan past the end of the readfile() buffer; the next binput()/strchr() in the loader then read out of bounds. A cache truncated by a crash or a full disk, or one handed to --update/--continue, reaches it. Bound both the copy and the advance in cache_brstr to the bytes actually present (strnlen up to the terminating NUL), and add cache_binput(), a binput() that refuses to start a read at or past end-of-buffer, for the two loader scan loops in htscache.c and htscoremain.c; the latter also gains the a < end guard the former already had. Regression: -#test=cacheindex plus 01_engine-cacheindex.test (the deterministic bound check fails on the old advance; the ASan CI jobs also exercise the scan). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com>
httrack-gh-release stages its signed tarballs in dist/ inside the checkout; only root-level /httrack-*.tar.gz was ignored, so a broad git add swept the 3.49.10/3.49.11 artifacts into this branch's first commit (since rewritten out). Ignore the directory. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com>
This was referenced Jul 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A corrupt or truncated
hts-cache/*.ndxwalked the cache loader's length-prefixed scan past the end of thereadfile()buffer: an out-of-bounds read reachable on--update/--continue, or from a cache truncated by a crash or a full disk.cache_brstradvanced its cursor by the on-disk length prefix (clamped only to 32768) without checking those bytes were actually present, so a short file whose declared length overstates it sent the cursor past the terminating NUL; the nextbinput()/strchr()in the loader then read out of bounds. The fix bounds both the copy and the advance to the bytes actually there (strnlenup to the NUL), and addscache_binput(), abinput()that refuses to start a read at or past end-of-buffer, for the two loader scan loops. The listing loop in htscoremain.c also picks up thea < endguard the main htscache.c loop already had.-#test=cacheindexgates it: the deterministic bound check fails on the old advance, and the ASan CI jobs exercise the scan itself. Found with the cache-index fuzz harness in the follow-up PR.Also adds dist/ to .gitignore: httrack-gh-release stages signed tarballs there, and the missing rule let them slip into an earlier revision of this PR.