From aa1c17adf97e606ce854394ec1094af32fe5816b Mon Sep 17 00:00:00 2001 From: "Gabriel A. Devenyi" Date: Sat, 15 Aug 2026 16:26:39 -0400 Subject: [PATCH] BUG: Stop loc_strnlen reading one byte past the buffer it is given loc_strnlen measures a string that need not be terminated, but it dereferences before testing the bound, so when no NUL appears in the first maxlen bytes the last iteration reads str[maxlen]. Both callers pass an unterminated buffer: axml_read_buf takes the caller's buffer and its length, and axml_read_file measures what fread returned, which fills the buffer for any larger file. AddressSanitizer on a buffer sized to its content reports a heap-buffer-overflow read 0 bytes after a 324-byte region. The returned length is unchanged wherever the old order was in bounds. (cherry picked from commit 7476a12456cda09e48f4e5d4d7c632b46fe44da0) --- cifti/afni_xml.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/cifti/afni_xml.c b/cifti/afni_xml.c index a9910a1b..d7cc9a4f 100644 --- a/cifti/afni_xml.c +++ b/cifti/afni_xml.c @@ -1021,7 +1021,8 @@ static int64_t loc_strnlen(const char * str, int64_t maxlen) const char * sptr; int64_t len; - for( sptr=str, len=0; *sptr && len