andersen-lab / ivar

iVar is a computational package that contains functions broadly useful for viral amplicon-based sequencing.
https://andersen-lab.github.io/ivar/html/
GNU General Public License v3.0
115 stars 39 forks source link

Silent integer overflows in several ivar params #145

Closed wm75 closed 1 year ago

wm75 commented 1 year ago

Describe the bug https://github.com/andersen-lab/ivar/blob/d0e2ad0e6be69307771a5d36c573ffba578f4ce0/src/ivar.cpp#L22-L47 defines several command line arguments as uint8_t, which results in unexpected integer overflow behavior when users pass values >255.

min_depth used by ivar consensus might be the most dangerous case as it seems rather likely that a user would require more than 255 as the depth for calling a consensus base (at least with high coverage data). It's also an easy to test case cause the stdout mentions the parsed depth.

The other cases should be addressed as well though.