From e880183c8ce1ea06b6597dd104638b9db121bb19 Mon Sep 17 00:00:00 2001 From: Ziya Kapoor Date: Mon, 2 Nov 2026 22:24:48 +0530 Subject: [PATCH] por: stop reading past the number buffer in read_double_with_peek read_double_with_peek collects a number into buffer[100] up to the terminating '/' but never NUL-terminates it. When readstat_por_parse_double rejects the string and an error handler is set, the error message passes buffer to a bare %s, so snprintf reads past the bytes taken from the file into the rest of the stack frame and copies them into the message. Print buffer with the length that was read, as the conversion error just above already does. --- src/spss/readstat_por_read.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/spss/readstat_por_read.c b/src/spss/readstat_por_read.c index 5fae799b..1f7c06a8 100644 --- a/src/spss/readstat_por_read.c +++ b/src/spss/readstat_por_read.c @@ -138,8 +138,8 @@ static readstat_error_t read_double_with_peek(por_ctx_t *ctx, double *out_double bytes_read = readstat_por_parse_double(utf8_buffer, len, &value, ctx->handle.error, ctx->user_ctx); if (bytes_read == -1) { if (ctx->handle.error) { - snprintf(error_buf, sizeof(error_buf), "Error parsing double string (length=%" PRId64 "): %.*s [%s]", - len, (int)len, utf8_buffer, buffer); + snprintf(error_buf, sizeof(error_buf), "Error parsing double string (length=%" PRId64 "): %.*s [%.*s]", + len, (int)len, utf8_buffer, (int)i, buffer); ctx->handle.error(error_buf, ctx->user_ctx); } retval = READSTAT_ERROR_PARSE;