<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /></head><body style='font-size: 10pt; font-family: Verdana,Geneva,sans-serif'>
<div><span>Package: sweed</span></div>
<div><span>Version: 3.2.1+dfsg-5</span></div>
<div><span> </span></div>
<div><span>Dear Maintainers,</span></div>
<div><span> </span></div>
<div><span>We are researching static analysis for recurring vulnerabilities. When using our tool to test on 'sweed', we found a suspicious integer overflow to buffer overflow at 'readAlignmentMS' in 'SweeD_Input.c'. 'alignment->segsites' which was read by 'fscanf' in line 3341 would be used directly to allocate memory in line 3345 and 3346 with no check. We suggest adding an integer overflow check before memory allocation to prevent buffer overflow.</span></div>
<div><span> </span></div>
<div><span>Thank you for maintaining sweed.</span></div>
<div><span> </span></div>
<div><span>Best regards</span></div>
</body></html>