From df2c3f12bfda6cb618667091894f68958fb31060 Mon Sep 17 00:00:00 2001
From: orbisai0security <mediratta01.pally@gmail.com>
Date: Wed, 29 Apr 2026 12:35:18 +0000
Subject: [PATCH] fix: V-001 security vulnerability

Automated security fix generated by Orbis Security AI
---
 third_party/utf8_range/lemire-avx2.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/third_party/utf8_range/lemire-avx2.c b/third_party/utf8_range/lemire-avx2.c
index ab61c2cc48f81..a91ad9020b06f 100644
--- a/third_party/utf8_range/lemire-avx2.c
+++ b/third_party/utf8_range/lemire-avx2.c
@@ -214,8 +214,10 @@ int utf8_lemire_avx2(const unsigned char *src, int len) {
   // last part
   if (i < len) {
     char buffer[32];
-    memset(buffer, 0, 32);
-    memcpy(buffer, src + i, len - i);
+    size_t tail = (size_t)(len - i);
+    if (tail > sizeof(buffer)) tail = sizeof(buffer);
+    memset(buffer, 0, sizeof(buffer));
+    memcpy(buffer, src + i, tail);
     __m256i current_bytes = _mm256_loadu_si256((const __m256i *)(buffer));
     previous = avxcheckUTF8Bytes(current_bytes, &previous, &has_error);
   } else {