zhanxw / seqminer

Query sequence data (VCF/BCF1/BCF2, Tabix, BGEN, PLINK) in R
http://zhanxw.github.io/seqminer/
Other
30 stars 12 forks source link

Fix buffer overflows #29

Closed pekkarr closed 9 months ago

pekkarr commented 9 months ago

Fix buffer overflows with C++ vectors and strings, making seqminer capable of running on Linux systems that enable -D_GLIBCXX_ASSERTIONS compiler flag, like Arch Linux and Fedora. That flag aborts the R process when it detects a buffer overflow at runtime, so without this patch for example tabix.read() results in a coredump. I have tested that the package unit tests pass on Arch Linux with this patch (previously those lead to a coredump).

Fixes #21.

The two fixes in RangeList.h are related to the RangeList::end() iterator. The chromIndex of that iterator is equal to chromSize, so the ChromVector shouldn't be accessed in that case using the index. The second fix in that file is relevant when an iterator is incremented until it's equal to RangeList::end().

The fix in SingleChromosomeBCFIndex.cpp moves the read of the buffer's last character up, because the string buffer is shrunk in a loop with s.resize(s.size() - 1). This changes the length of the string, and accessing characters after the new end is undefined behavior, so the last character needs to be read before the string is shrunk.