[Pranav-error]

Fixes #7942.

format_double() (lib/gis/wind_format.c) uses sprintf(buf, "%.8f", value) for any non-lat/lon projection. %.8f on a double has no fixed maximum width -- DBL_MAX needs 318 characters -- but the callers changed here pass a fixed local buffer sized for an ordinary coordinate: 30 bytes in r.coin, 50 in r.report, ps.map, and d.where.

The value comes from the current region, settable via g.region. scan_double() (lib/gis/wind_scan.c), which parses g.region's n=/s=/e=/w= for any non-lat/lon projection, is a bare sscanf with no magnitude check, so an extreme value is accepted and can reach these buffers when one of the four programs formats it.

Reproduced with format_double() extracted verbatim (matched by function name, not retyped) into a standalone harness under AddressSanitizer: 9e19 (29-char result) is clean, 1e20 (30 characters, one more than a 30-byte buffer can hold with the terminator) overflows. DBL_MAX needs exactly 318 characters, measured directly with sprintf into a 512-byte scratch buffer.

Fix: bump each buffer to 320 bytes (sign + DBL_MAX's 318 digits + terminator) rather than changing format_double()'s signature -- it's called from many places across the tree with no size parameter today, and widening a public API felt like a separate decision from fixing four buffers that are simply too small for what it already does. Happy to go the other way (a bounded snprintf inside format_double() itself) if you'd rather standardize there.

Testing: clang-format is clean on all four files. I did not attempt a full build -- this machine is low on disk space, and the change is a pure buffer-size literal with no logic difference (same four lines, larger numbers), so a full multi-GB build felt like more risk to my disk than confidence gained. The actual defect (the unbounded write) is what's ASAN-verified above; each affected call site was individually located and its buffer size checked, not assumed from the one function.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[nilason]

Please remove the comments, the info belongs to the commit message.

[echoix]

How were you able to do the asan verifications before and after (if you actually did), without doing a grass build? Seems a little contradictory, unless not explained well

[Pranav-error]

Yes -- no full build, deliberately. format_double() (and the four call sites) were extracted verbatim, matched by function name and not retyped, into a standalone harness compiled with -fsanitize=address. The harness calls the function directly with the boundary values (9e19, 1e20, DBL_MAX) against a buffer sized like the real one, so ASAN can catch the overflow at the exact byte. Disk space on this machine ruled out a full GRASS build (same constraint as the buffer sizes themselves being small local arrays -- no logic change, just literals), so that's the extent of the verification: the extracted function under ASAN, not the built binary in the full pipeline.

Happy to do a full build and rerun if that's wanted for confidence here -- just flagging it wasn't done yet.

[nilason]

This looks good to me, but, again please remove the comments in code. You might add a very short notice (on min buffer size) in the functions \param dox in lib/gis/wind_format.c.

[Pranav-error]

Added a short note on the minimum buffer size to the \param[out] buf docs for G_format_northing/G_format_easting/G_format_resolution in wind_format.c. Comments removed from all four call sites.

[Pranav-error]

Taken exactly as suggested, applied to all three functions (G_format_northing/easting/resolution).