[Debian-med-packaging] Bug#715703: Bug#715703: Please do not close issues that remain

[Andreas Tille]

Hi Charles,

On Mon, Jul 13, 2015 at 05:53:29AM +0900, Charles Plessy wrote:
> Le Sun, Jul 12, 2015 at 03:13:32PM +0200, Andreas Tille a écrit :
> > 
> > Since you seem to have contact to upstream would you mind forwarding
> > all three existing patches?
> 
> Thanks Andreas, but this patch will not solve the issue.  The following
> commands also crashes bwa:
> 
>     bwa bwtupdate - < <(echo AAAAAAAAAAAAAAAAAAAAAAAA)
> 
>     bwa bwtupdate <(echo AAAAAAAAAAAAAAAAAAAAAAAA)
> 
> The problem is: the command expects a bwa index in an old format (let's call it
> 0.5), and will convert it to the latest version (let's call it 0.6).

I'd consider this structurally different.  The bug report ended in a segfault
with exit status 139.

Your examples will end the program as well but not with a segfault but with
exit code 1.
 
> What would be neded here is some code that checks that the input is really in
> the expected format, and gracefully returns an appropriate error message.
> Needless to say, I do not know the magic number for bwa indexes version 0.5.
> The change of index format happened in 2011.

I agree that the check is not perfect, that's really true.  However, the
*security issue* found by Mayhem is actually fixed.
 
> So I recommend to keep this bug closed :)

Which is totally correct. :-)

Kind regards

        Andreas. 

-- 
http://fam-tille.de