[med-svn] [Git][med-team/pbseqlib][master] 5 commits: Guard out-of-range reads when an anchor match list has exactly one entry Closes: #1091721
Andreas Tille (@tille)
gitlab at salsa.debian.org
Fri Oct 23 16:24:59 BST 2026
Andreas Tille pushed to branch master at Debian Med / pbseqlib
Commits:
b74b9cd8 by Andreas Tille at 2026-10-23T15:38:56+02:00
Guard out-of-range reads when an anchor match list has exactly one entry Closes: #1091721
- - - - -
9bc77b76 by Andreas Tille at 2026-10-23T15:39:06+02:00
Remove redundant fields from d/watch
- - - - -
f8775a76 by Andreas Tille at 2026-10-23T15:42:11+02:00
Changes made by cme
- - - - -
d7b33324 by Andreas Tille at 2026-10-23T14:42:15+01:00
Set upstream metadata fields: Bug-Submit.
Changes-By: lintian-brush
Fixes: lintian: source: upstream-metadata-missing-bug-tracking [debian/upstream/metadata]
See-also: https://lintian.debian.org/tags/upstream-metadata-missing-bug-tracking.html
- - - - -
72ab3c5f by Andreas Tille at 2026-10-23T15:46:17+02:00
routine-update: Ready to upload to unstable
- - - - -
6 changed files:
- debian/changelog
- debian/control
- + debian/patches/pbseqlib-findmaxinterval-size1-oob.patch
- debian/patches/series
- debian/upstream/metadata
- debian/watch
Changes:
=====================================
debian/changelog
=====================================
@@ -1,3 +1,12 @@
+pbseqlib (5.3.5+dfsg-13) unstable; urgency=medium
+
+ * Guard out-of-range reads when an anchor match list has exactly one entry
+ Closes: #1091721
+ * Remove redundant fields from d/watch
+ * Set upstream metadata fields: Bug-Submit.
+
+ -- Andreas Tille <tille at debian.org> Fri, 23 Oct 2026 15:42:19 +0200
+
pbseqlib (5.3.5+dfsg-12) unstable; urgency=medium
* Build with gcc-16
=====================================
debian/control
=====================================
@@ -6,19 +6,19 @@ Uploaders:
Section: science
Build-Depends:
debhelper-compat (= 14),
- d-shlibs,
- meson,
- pkgconf,
cmake,
+ d-shlibs,
googletest,
- libgtest-dev,
- zlib1g-dev,
- libhdf5-dev,
libboost-dev,
libboost-iostreams-dev,
+ libgtest-dev,
+ libhdf5-dev,
+ libhts-dev (>= 1.20+ds-2~),
libpbbam-dev (>> 2.3.0),
libpbcopper-dev (>> 2.2.0),
- libhts-dev (>= 1.20+ds-2~),
+ meson,
+ pkgconf,
+ zlib1g-dev,
Vcs-Browser: https://salsa.debian.org/med-team/pbseqlib
Vcs-Git: https://salsa.debian.org/med-team/pbseqlib.git
Homepage: https://github.com/PacificBiosciences/blasr_libcpp
@@ -45,8 +45,8 @@ Architecture: any
Multi-Arch: same
Section: libs
Depends:
- ${shlibs:Depends},
${misc:Depends},
+ ${shlibs:Depends},
Description: tools for aligning PacBio reads to target sequences
Blasr_libcpp is a library used by blasr and other executables such as
samtoh5, loadPulses for analyzing PacBio sequences. This library contains
@@ -58,8 +58,8 @@ Package: libpbseq
Architecture: any
Multi-Arch: same
Depends:
- ${misc:Depends},
libblasr5.3.5 (= ${binary:Version}),
+ ${misc:Depends},
Description: library for analyzing PacBio sequencing data
Blasr_libcpp is a library used by blasr and other executables such as
samtoh5, loadPulses for analyzing PacBio sequences. This library contains
@@ -72,10 +72,10 @@ Architecture: any
Multi-Arch: same
Section: libdevel
Depends:
- ${misc:Depends},
+ libblasr-dev (= ${binary:Version}),
libpbdata-dev (= ${binary:Version}),
libpbihdf-dev (= ${binary:Version}),
- libblasr-dev (= ${binary:Version}),
+ ${misc:Depends},
Description: library for analyzing PacBio sequencing data (development files)
Blasr_libcpp is a library used by blasr and other executables such as
samtoh5, loadPulses for analyzing PacBio sequences. This library contains
@@ -88,8 +88,8 @@ Architecture: any
Multi-Arch: same
Section: libdevel
Depends:
- ${misc:Depends},
libpbcopper-dev,
+ ${misc:Depends},
Description: tools for handling PacBio sequences (development files)
Blasr_libcpp is a library used by blasr and other executables such as
samtoh5, loadPulses for analyzing PacBio sequences. This library contains
=====================================
debian/patches/pbseqlib-findmaxinterval-size1-oob.patch
=====================================
@@ -0,0 +1,63 @@
+Description: Guard out-of-range reads when an anchor match list has exactly one entry
+ ExhaustiveFindMaxIncreasingInterval (and the Fast-finder helper
+ StoreLargestIntervals) unconditionally read pos[next] where
+ next = cur + 1 = 1, and later pos[cur] after advancing cur to the end,
+ assuming at least two anchors. For a match list with a single anchor
+ (pos.size() == 1) this indexes past the end of the
+ std::vector<ChainedMatchPos>. With _GLIBCXX_ASSERTIONS
+ (default hardening in Debian toolchains) this aborts with
+ "std::vector<ChainedMatchPos>::operator[] ... Assertion '__n <
+ this->size()' failed", i.e. "Assertion '__n < this->size()' failed",
+ killing BLASR. The PBHoney 'Honey pie' tail remapping step routinely
+ produces single-anchor read lists, so the pbsuite autopkgtest
+ (Debian bug #1091721) crashes and fails on unstable/testing/stable.
+ Without assertions the same reads walk out of bounds (undefined
+ behavior), yielding garbage alignment results.
+ .
+ Fix: guard the two boundary reads (next < nPos, cur < nPos) so a
+ single-anchor list is processed in the existing "next - cur == 1"
+ single-match branch and the loop terminates cleanly. Also make
+ StoreLargestIntervals return early for pos.size() <= 1 (a single
+ anchor cannot form a cluster), which is the identical off-by-one
+ exposed when --fast-max-interval is used.
+Author: Debian Med packaging team <debian-med-packaging at lists.alioth.debian.org>
+Bug-Debian: https://bugs.debian.org/1091721
+Forwarded: not-needed (upstream blasr/pbseq is archived and unmaintained)
+Last-Update: 2026-10-23
+Assisted-By: scaleway/deepseek-v4-flash-0731
+
+--- a/alignment/algorithms/anchoring/FindMaxIntervalImpl.hpp
++++ b/alignment/algorithms/anchoring/FindMaxIntervalImpl.hpp
+@@ -184,7 +184,7 @@ void StoreLargestIntervals(T_MatchList &pos,
+ int minSize, std::vector<DNALength> &start, std::vector<DNALength> &end)
+ {
+
+- if (pos.size() == 0) {
++ if (pos.size() <= 1) {
+ return;
+ }
+ //
+@@ -682,7 +682,9 @@ int ExhaustiveFindMaxIncreasingInterval(
+ (void)(endOfCurrentInterval);
+
+ curBoundary = ContigStartPos(pos[cur].t);
+- nextBoundary = ContigStartPos(pos[next].t);
++ if (next < nPos) {
++ nextBoundary = ContigStartPos(pos[next].t);
++ }
+ std::vector<UInt> scores, prevOpt;
+
+ //
+@@ -894,8 +896,10 @@ int ExhaustiveFindMaxIncreasingInterval(
+ // boundary of the current contig.
+ //
+
+- curBoundary = ContigStartPos(pos[cur].t);
+- contigLength = ContigStartPos.Length(pos[cur].t);
++ if (cur < nPos) {
++ curBoundary = ContigStartPos(pos[cur].t);
++ contigLength = ContigStartPos.Length(pos[cur].t);
++ }
+
+ //
+ // Previously tried to advance half. This is being removed since
=====================================
debian/patches/series
=====================================
@@ -6,3 +6,4 @@ gcc-13.patch
pbbam_2.3.0
gcc-14.patch
gcc-16.patch
+pbseqlib-findmaxinterval-size1-oob.patch
=====================================
debian/upstream/metadata
=====================================
@@ -1,2 +1,3 @@
---
Bug-Database: https://github.com/PacificBiosciences/blasr_libcpp/issues
+Bug-Submit: https://github.com/PacificBiosciences/blasr_libcpp/issues/new
=====================================
debian/watch
=====================================
@@ -3,7 +3,5 @@ Untrackable: upstream vanished.
Source: https://github.com//PacificBiosciences/blasr_libcpp/tags
Matching-Pattern: .*/@ANY_VERSION@@ARCHIVE_EXT@
-Compression: xz
Dversion-Mangle: s/\+dfsg//g
-Repack: yes
Repack-Suffix: +dfsg
View it on GitLab: https://salsa.debian.org/med-team/pbseqlib/-/compare/6c65a7ffe563e3b97cba281e47008b8974fec31d...72ab3c5f039b0c244783ea5334e9a43503b467e1
--
View it on GitLab: https://salsa.debian.org/med-team/pbseqlib/-/compare/6c65a7ffe563e3b97cba281e47008b8974fec31d...72ab3c5f039b0c244783ea5334e9a43503b467e1
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-med-commit/attachments/20261023/3d1c4347/attachment-0001.htm>
More information about the debian-med-commit
mailing list