[bwa_index] Pack FASTA... *** buffer overflow detected ***

[H4niz]

I found a buffer overflow in [bns_fasta2bntseq] function.

int64_t bns_fasta2bntseq(gzFile fp_fa, const char *prefix, int for_only)
{
	extern void seq_reverse(int len, ubyte_t *seq, int is_comp); // in bwaseqio.c
	kseq_t *seq;
	char name[1024];
	bntseq_t *bns;
	uint8_t *pac = 0;
	int32_t m_seqs, m_holes;
	int64_t ret = -1, m_pac, l;
	bntamb1_t *q;
	FILE *fp;

	// initialization
	....
	strcpy(name, prefix); strcat(name, ".pac");
	...
	return ret;
}

The name buffer has only 1024 bytes, in order that buffer overflow occurs if we pass more than 1024 bytes as prefix. It's a vulnerability

[yanlinlin82]

This could be fixed by snprintf, like:

snprintf(name, sizeof(name), "%s.pac", prefix);

[H4niz]

In other function, that use the same input with [bns_fasta2bntseq] function, [bns_dump] function in btnseq.c. There is a buffer overflow here.

void bns_dump(const bntseq_t *bns, const char *prefix)
{
	char str[1024];
	FILE *fp;
	int i;
	{ // dump .ann
		strcpy(str, prefix); strcat(str, ".ann");
(......)
	{ // dump .amb
		strcpy(str, prefix); strcat(str, ".amb");
(....)
}

The buffer overflow occur in str buffer. They can be fixed by snprintf, like @yanlinlin82 recommendation.

[carnil]

CVE-2019-11371 was assigned for this issue.

[pfsmorigo]

Any update?