From 8f5eb1e4f49abd159617797ed94884c4e258fafb Mon Sep 17 00:00:00 2001
From: Yuval Tassa <tassa@google.com>
Date: Thu, 8 Jan 2026 02:42:05 -0800
Subject: [PATCH] Improve bounds checking in `engine_util_solve.c`.

Add checks to ensure `snprintf` does not write beyond the allocated log buffer size, preventing buffer overflows.

Fixes #2661, #2673

PiperOrigin-RevId: 853643867
Change-Id: Ibdc47810158466dc961767284ac297df98916dac
---
 src/engine/engine_util_solve.c | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/src/engine/engine_util_solve.c b/src/engine/engine_util_solve.c
index be43b1c8..426f214e 100644
--- a/src/engine/engine_util_solve.c
+++ b/src/engine/engine_util_solve.c
@@ -1534,12 +1534,15 @@ int mju_boxQPoption(mjtNum* res, mjtNum* R, int* index,               // outputs
 
 
     // print iteration info
-    if (log) {
-      logptr += snprintf(log+logptr, logsz-logptr,
-                         "iter %-3d:  |grad|: %-8.2g  reduction: %-8.2g  improvement: %-8.4g  "
-                         "linesearch: %g^%-2d  factorized: %d  nfree: %d\n",
-                         iter+1, mju_sqrt(norm2), oldvalue-value, improvement,
-                         backtrack, nstep-1, factorize, nfree);
+    if (log && logptr < logsz) {
+      int written = snprintf(log+logptr, logsz-logptr,
+                             "iter %-3d:  |grad|: %-8.2g  reduction: %-8.2g  improvement: %-8.4g  "
+                             "linesearch: %g^%-2d  factorized: %d  nfree: %d\n",
+                             iter+1, mju_sqrt(norm2), oldvalue-value, improvement,
+                             backtrack, nstep-1, factorize, nfree);
+      if (written > 0) {
+        logptr = mjMIN(logptr + written, logsz);
+      }
     }
 
     // accept candidate
@@ -1552,7 +1555,7 @@ int mju_boxQPoption(mjtNum* res, mjtNum* R, int* index,               // outputs
   }
 
   // print final info
-  if (log) {
+  if (log && logptr < logsz) {
     snprintf(log+logptr, logsz-logptr, "BOXQP: %s.\n"
              "iterations= %d,  factorizations= %d,  |grad|= %-12.6g, final value= %-12.6g\n",
              status_string[status+1], iter, nfactor, mju_sqrt(norm2), value);