[ziyziy89]

read_double_with_peek in the POR reader collects a number into the stack array buffer[100] up to the terminating /, but never NUL-terminates it. When readstat_por_parse_double rejects the string and an error handler is installed, the message passes buffer to a bare %s, so snprintf reads past the bytes taken from the file into the unused tail of buffer and the neighbouring utf8_buffer, and copies that stack data into the message given to the handler. A .por file whose numeric field is 98 X characters followed by / is enough: readstat bad.por out.csv (the CLI always sets an error handler) stops with an ASan stack-buffer-overflow READ at readstat_por_read.c:141. The fuzz targets don't install an error handler, which is likely why this hasn't come up there.

Print buffer with the length that was actually read, the same way the conversion error a few lines up already does. With the change the same file reports Error parsing double string (length=99): XXX.../ [XXX.../] and still fails with READSTAT_ERROR_PARSE. test_readstat, test_dta_days, test_sav_date and test_double_decimals pass under ASan/UBSan.