@@ -910,7 +910,7 @@ bam_hdr_t *sam_hdr_parse(int l_text, const char *text)
910910 for (p = text ; * p ; ++ p ) {
911911 if (strncmp (p , "@SQ\t" , 4 ) == 0 ) {
912912 char * sn = 0 ;
913- int ln = -1 ;
913+ int64_t ln = -1 ;
914914 for (q = p + 4 ;; ++ q ) {
915915 if (strncmp (q , "SN:" , 3 ) == 0 ) {
916916 q += 3 ;
@@ -927,6 +927,10 @@ bam_hdr_t *sam_hdr_parse(int l_text, const char *text)
927927 if (sn && ln >= 0 ) {
928928 khint_t k ;
929929 int absent ;
930+ if (ln > UINT32_MAX ) {
931+ hts_log_error ("Reference '%s' is too long" , sn );
932+ return NULL ; // FIXME: Leaks memory
933+ }
930934 k = kh_put (s2i , d , sn , & absent );
931935 if (!absent ) {
932936 hts_log_warning ("Duplicated sequence '%s'" , sn );
@@ -1111,7 +1115,7 @@ int sam_hdr_write(htsFile *fp, const bam_hdr_t *h)
11111115 for (i = 0 ; i < h -> n_targets ; ++ i ) {
11121116 fp -> line .l = 0 ;
11131117 kputsn ("@SQ\tSN:" , 7 , & fp -> line ); kputs (h -> target_name [i ], & fp -> line );
1114- kputsn ("\tLN:" , 4 , & fp -> line ); kputw (h -> target_len [i ], & fp -> line ); kputc ('\n' , & fp -> line );
1118+ kputsn ("\tLN:" , 4 , & fp -> line ); kputuw (h -> target_len [i ], & fp -> line ); kputc ('\n' , & fp -> line );
11151119 if ( hwrite (fp -> fp .hfile , fp -> line .s , fp -> line .l ) != fp -> line .l ) return -1 ;
11161120 }
11171121 }
0 commit comments