From cce7fb04d14f62fb19c6415903f7ea6ed1fb8ea0 Mon Sep 17 00:00:00 2001
From: Yuval Tassa <tassa@google.com>
Date: Thu, 25 May 2023 06:24:27 -0700
Subject: [PATCH] Fix out of bounds write in `clampedDiff` in
 engine_derivative_fd.c

PiperOrigin-RevId: 535234007
Change-Id: I1ca54df1324346cd250409125939fdf6f63cee04
---
 src/engine/engine_derivative_fd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/engine/engine_derivative_fd.c b/src/engine/engine_derivative_fd.c
index d1ab7d83..e53736a0 100644
--- a/src/engine/engine_derivative_fd.c
+++ b/src/engine/engine_derivative_fd.c
@@ -122,7 +122,7 @@ static void clampedStateDiff(const mjModel* m, mjtNum* ds, const mjtNum* s, cons
     stateDiff(m, ds, s_minus, s_plus, 2*h);
   } else {
     // differencing failed, write zeros
-    mju_zero(ds, m->nq + m->nv + m->na);
+    mju_zero(ds, 2*m->nv + m->na);
   }
 }