Skip to content

Commit 077cf70

Browse files
authored
Fix possible 1 byte underflow in find_file_extension() (#1840)
When checking for another delimiter before .gz or .bgz, the pointer into the string was decremented without checking to see if was at the start. This could lead to a one byte read before the start of the string when copying out the delimiter. Credit to OSS_Fuzz Fixes oss-fuzz id 71740
1 parent 4dc620e commit 077cf70

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

hts_internal.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -129,7 +129,7 @@ static inline int find_file_extension(const char *fn, char ext_out[static HTS_MA
129129
if (!fn) return -1;
130130
if (!delim) delim = fn + strlen(fn);
131131
for (ext = delim; ext > fn && *ext != '.' && *ext != '/'; --ext) {}
132-
if (*ext == '.' &&
132+
if (*ext == '.' && ext > fn &&
133133
((delim - ext == 3 && ext[1] == 'g' && ext[2] == 'z') || // permit .sam.gz as a valid file extension
134134
(delim - ext == 4 && ext[1] == 'b' && ext[2] == 'g' && ext[3] == 'z'))) // permit .vcf.bgz as a valid file extension
135135
{

0 commit comments

Comments
 (0)