Client programs may crash by calling listAllAPIDataCSV of EnergyPlus API. [closed]

savecancel

I found a bug in a source file of EnergyPlus/api/datatransfer.cc. (Version 22.2.0)

At the end of the definition of listAllAPIDataCSV function, there are following codes.

char *p = new char[std::strlen(output.c_str())];
std::strcpy(p, output.c_str());
return p;

I think that strcpy function copies null character after the string, so length of new char[] has to be strlen() + 1 byte or more.