From 216109b8ed5dafa7c241f5309655ba6d86a9ba38 Mon Sep 17 00:00:00 2001
From: "andrey.bychkov" <andrey@signalmodelling.ru>
Date: Wed, 5 Aug 2026 17:37:35 +0300
Subject: [PATCH] fix(PIString): initialize toChar() return value and fix
 operator+= OOB

- toChar(): char v was uninitialized, causing UB when
  sscanf fails to match (empty string). Initialize to 0.

- operator+=(PIConstChars): loop iterated l < d.size() instead of
  l < str.size(), reading past the end of str after d.enlarge().
  This is a heap buffer overread with undefined behavior.
---
 libs/main/text/pistring.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libs/main/text/pistring.cpp b/libs/main/text/pistring.cpp
index db3b9da8..65bf8035 100644
--- a/libs/main/text/pistring.cpp
+++ b/libs/main/text/pistring.cpp
@@ -671,7 +671,7 @@ PIString & PIString::operator+=(const PIConstChars & str) {
 	if (!str.isEmpty()) {
 		size_t os = d.size();
 		d.enlarge(str.size());
-		for (size_t l = 0; l < d.size(); ++l) {
+		for (size_t l = 0; l < str.size(); ++l) {
 			d[os + l] = str[l];
 		}
 	}
@@ -1763,7 +1763,7 @@ PIString PIString::toLowerCase() const {
 
 
 char PIString::toChar() const {
-	char v;
+	char v = 0;
 	sscanf(dataAscii(), "%c", &v);
 	return v;
 }