From 617a7902f2666dcc115ebafab73455c01530a146 Mon Sep 17 00:00:00 2001 From: Jacqueline Garrahan Date: Tue, 14 Jul 2026 15:20:36 -0700 Subject: [PATCH] printfRecord: fix one-byte VAL overflow in %ls conversion In the long-string (%ls) branch dbGetLink(DBR_CHAR) / dbLoadLinkLS can leave n at vspace+1, so pval[n] = 0 writes at pval[vspace+1], one byte past the sizv-byte VAL buffer (pval + vspace + 1 == prec->val + sizv). Clamp n to vspace immediately before writing the terminator. Co-Authored-By: Claude Opus 4.8 (1M context) --- modules/database/src/std/rec/printfRecord.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/modules/database/src/std/rec/printfRecord.c b/modules/database/src/std/rec/printfRecord.c index 64cf7b291..c09b460ba 100644 --- a/modules/database/src/std/rec/printfRecord.c +++ b/modules/database/src/std/rec/printfRecord.c @@ -250,6 +250,8 @@ static void doPrintf(printfRecord *prec) int padding; /* Terminate string and measure its length */ + if (n > vspace) + n = vspace; pval[n] = 0; added = strlen(pval); padding = width - added;