Fix buffer overflow in 'samtools depad' with CIGAR D operators

[samtools.git] / padding.c

diff --git a/padding.c b/padding.c
index 6e40833c9a7b20b24029b75f87b504f3503330d2..b544aab20bcb25fe5700543ada6cf83371d253c6 100644 (file)
--- a/padding.c
+++ b/padding.c
@@ -30,9 +30,21 @@ static void replace_cigar(bam1_t *b, int n, uint32_t *cigar)
 static void unpad_seq(bam1_t *b, kstring_t *s)
 {
        int k, j, i;
+       int length;
        uint32_t *cigar = bam1_cigar(b);
        uint8_t *seq = bam1_seq(b);
-       ks_resize(s, b->core.l_qseq);
+       // b->core.l_qseq gives length of the SEQ entry (including soft clips, S)
+       // We need the padded length after alignment from the CIGAR (excluding
+       // soft clips S, but including pads)
+       length = 0;
+       for (k = 0; k < b->core.n_cigar; ++k) {
+               int op, ol;
+               op= bam_cigar_op(cigar[k]);
+               ol = bam_cigar_oplen(cigar[k]);
+               if (op == BAM_CMATCH || op == BAM_CEQUAL || op == BAM_CDIFF || op == BAM_CDEL || op == BAM_CPAD)
+                       length += ol;
+       }
+       ks_resize(s, length);
        for (k = 0, s->l = 0, j = 0; k < b->core.n_cigar; ++k) {
                int op, ol;
                op = bam_cigar_op(cigar[k]);
@@ -50,6 +62,7 @@ static void unpad_seq(bam1_t *b, kstring_t *s)
                         assert(-1);
                }
        }
+       assert(length == s->l);
 }
 
 int bam_pad2unpad(bamFile in, bamFile out)
@@ -136,7 +149,7 @@ int bam_pad2unpad(bamFile in, bamFile out)
                                        pre_op = bam_cigar_op(cigar2[i-2]);
                                        post_op = bam_cigar_op(cigar2[i]);
                                        /* Note don't need to check for X/= as code above will use M only */
-                                       if ((pre_op == BAM_CMATCH || pre_op == BAM_CDIFF) && (post_op == BAM_CMATCH || post_op == BAM_CDIFF)) {
+                                       if ((pre_op == BAM_CMATCH || pre_op == BAM_CDEL) && (post_op == BAM_CMATCH || post_op == BAM_CDEL)) {
                                                /* This is a redundant P operator */
                                                cigar2[i-1] = 0; // i.e. 0M
                                                /* If had same operator either side, combine them in post_op */