Bug Type: Security / Buffer Overflow / Crash
Description:
In src/conv/nastran-g.c, the PBAR and PSHELL conversion loops use sprintf to write group names into a fixed-size stack buffer:
char name[NAMESIZE+1]; // 17 bytes
sprintf(name, "pbar_group.%d", pbp->pid);
sprintf(name, "pshell.%d", psh->pid);
If the PID has more than 6 digits (or 10 digits for 32-bit max int), the resulting string exceeds the buffer size, causing a stack buffer overflow. This can crash nastran-g and theoretically allow code execution.
Proposed Fix:
Increase the buffer size to 32 bytes:
Use snprintf instead of sprintf:
snprintf(name, sizeof(name), "pbar_group.%d", pbp->pid);
snprintf(name, sizeof(name), "pshell.%d", psh->pid);