I found a bug in a source file of EnergyPlus/api/datatransfer.cpp. (Version 22.1.0)
At the end of the definition of listAllAPIDataCSV function, there are following codes.
char *p = new char[std::strlen(output.c_str())];
std::strcpy(p, output.c_str());
return p;
I think that strcpy function copies null character after the string, so length of new char[] has to be strlen() + 1 byte or more.