fix(c): two CRITICAL memory bugs in standalone C (ASan/test-confirmed)

1. read_file() called realloc() directly on buf.data, which may point at the
   4096-byte stack buffer (buffer_init uses stack storage when capacity<=4096).
   A file of exactly STACK_BUFFER_SIZE bytes -> realloc of a stack pointer ->
   heap corruption/crash. Now uses buffer_append(), which routes through
   buffer_grow() and correctly migrates stack->heap.

2. make_utf8() memcpy'd strlen(token) into a fixed uint8_t[4]; a runtime map
   (PRINTABLE_BINARY_MAP) with a >4-byte glyph token overflowed the stack.
   make_utf8 now clamps to MAX_UTF8_BYTES and load_map_from_path rejects
   over-long glyph tokens with a clear error.

Also: encode_data() was missing buffer_prepare_return() that every sibling
returner has (latent dangling-stack-return, masked only by INITIAL_BUFFER_SIZE
> STACK_BUFFER_SIZE); added for correctness/consistency.

Tests: test/test #5b (4095/4096/4097/8192-byte boundary roundtrip) and #5c
(malformed runtime map rejected, not crashed). Both RED before, GREEN after;
cross-impl-safe (Lua/Zig/C all pass).

Author: pmarreck

src/printable_binary.c

@@ -273,8 +273,10 @@ static void buffer_free(buffer_t *buf) {
 // Helper function to create UTF-8 sequence
 static utf8_sequence_t make_utf8(const char *bytes) {
     utf8_sequence_t seq = {0};
-    seq.length = strlen(bytes);
-    memcpy(seq.bytes, bytes, seq.length);
+    size_t len = strlen(bytes);
+    if (len > MAX_UTF8_BYTES) len = MAX_UTF8_BYTES; /* never overflow seq.bytes[4] */
+    seq.length = len;
+    memcpy(seq.bytes, bytes, len);
     return seq;
 }
 
@@ -343,6 +345,13 @@ static bool load_map_from_path(const char *path) {
             }
         }
 
+        if (strlen(buffer) > MAX_UTF8_BYTES) {
+            fprintf(stderr, "Error: character map '%s' glyph at index %d exceeds %d bytes\n",
+                    path, i, MAX_UTF8_BYTES);
+            fclose(fp);
+            exit(1);
+        }
+
         encode_table[i] = make_utf8(buffer);
         i++;
     }
@@ -952,6 +961,7 @@ static buffer_t encode_data(const uint8_t *input, size_t input_len, const option
         }
     }
 
+    buffer_prepare_return(&output);
     return output;
 }
 
@@ -1115,16 +1125,12 @@ static buffer_t read_file(const char *filename) {
     while (1) {
         size_t bytes_read = fread(temp, 1, sizeof(temp), file);
         if (bytes_read > 0) {
-            if (buf.size + bytes_read >= buf.capacity) {
-                buf.capacity = (buf.size + bytes_read) * 2;
-                buf.data = realloc(buf.data, buf.capacity);
-                if (!buf.data) {
-                    fprintf(stderr, "Memory allocation failed\n");
-                    exit(1);
-                }
-            }
-            memcpy(buf.data + buf.size, temp, bytes_read);
-            buf.size += bytes_read;
+            /* buffer_append routes through buffer_grow, which correctly migrates
+             * a stack-backed buffer to the heap. The previous hand-rolled realloc
+             * called realloc() directly on buf.data, corrupting/crashing when
+             * buf.data still pointed at the 4096-byte stack buffer (e.g. a file
+             * of exactly STACK_BUFFER_SIZE bytes). */
+            buffer_append(&buf, temp, bytes_read);
             continue;
         }
 

test/test

@@ -217,6 +217,42 @@ else
     exit 1
 fi
 
+# Test 5b: Buffer stack/heap boundary roundtrip
+# Regression: C buffer_init uses a 4096-byte stack buffer; read_file must not
+# realloc() that stack pointer. Exactly 4096 bytes is the crash boundary.
+echo -e "${BLUE}Test #5b: Buffer boundary roundtrip (4095/4096/4097/8192 bytes)${NC}"
+BOUNDARY_OK=1
+for sz in 4095 4096 4097 8192; do
+    head -c "$sz" /dev/zero | tr '\0' 'Z' > "$TMP_BINARY"
+    if ! $SCRIPT "$TMP_BINARY" > "$TMP_ENCODED" 2>/dev/null; then BOUNDARY_OK=0; echo "encode crashed at size $sz"; break; fi
+    if ! $SCRIPT -d "$TMP_ENCODED" > "$TMP_DECODED" 2>/dev/null; then BOUNDARY_OK=0; echo "decode crashed at size $sz"; break; fi
+    if ! cmp -s "$TMP_BINARY" "$TMP_DECODED"; then BOUNDARY_OK=0; echo "roundtrip mismatch at size $sz"; break; fi
+done
+if [[ "$BOUNDARY_OK" == "1" ]]; then
+    echo -e "${GREEN}PASS${NC}"
+else
+    echo -e "${RED}FAIL${NC}"
+    exit 1
+fi
+
+# Test 5c: Malformed runtime map (>4-byte glyph token) must be rejected, not crash
+# Regression: C make_utf8 memcpy'd strlen(token) into a 4-byte array (stack smash).
+echo -e "${BLUE}Test #5c: Malformed runtime map rejected gracefully${NC}"
+if [[ -f character_map.txt ]]; then
+    BADMAP=$(mktemp)
+    awk 'BEGIN{done=0} /^##/{print;next} (done==0){print "TOOLONG8"; done=1; next} {print}' character_map.txt > "$BADMAP"
+    rc=0
+    PRINTABLE_BINARY_MAP="$BADMAP" $SCRIPT <<< "x" >/dev/null 2>&1 || rc=$?
+    rm -f "$BADMAP"
+    if [[ $rc -ge 128 ]]; then
+        echo -e "${RED}FAIL${NC} (crashed with signal, exit $rc)"
+        exit 1
+    fi
+    echo -e "${GREEN}PASS${NC}"
+else
+    echo -e "${YELLOW}SKIP (no character_map.txt in cwd)${NC}"
+fi
+
 # Test 6: Piped input
 echo -e "${BLUE}Test #6: Piped input${NC}"
 RESULT=$(echo -n "Test" | $SCRIPT | $SCRIPT -d)