commit b818218f78655096354ebfe1e74cf1a4cdda0e14
Author: Robert Scheck <bird@robert-scheck.de>
Date:   Tue Oct 13 02:06:40 2026 +0200

    Lib: Fix stack overflow in bt_fmt_bytestr()
    
    bt_fmt_bytestr() allocates len + 1 bytes but writes two hex digits
    per byte plus a terminating NUL, overflowing the alloca() buffer.
    The formatter runs for every test case, not only on failure. On
    x86_64, alloca's 16-byte rounding usually hides the overflow; on
    s390x it smashes the stack and t_bstrhextobin/t_bstrbintohex fail.
    
    Allocate 2 * len + 1 bytes and print with %02x, so every byte is
    exactly two digits (the old %hx also dropped leading zeros).
    
    Target: patch
    Fixes: 3567ebc03

diff --git a/lib/strtoul_test.c b/lib/strtoul_test.c
index 788f214d2..573857653 100644
--- a/lib/strtoul_test.c
+++ b/lib/strtoul_test.c
@@ -201,11 +201,11 @@ bt_fmt_bytestr(char *buf, size_t size, const void *data_)
     return;
   }
 
-  char *tmp = allocz(data->len + 1);
+  char *tmp = allocz(2 * data->len + 1);
   char *t = tmp;
 
   for (int i = 0; i < data->len; i++)
-    t += bsprintf(t, "%hx", data->buf[i]);
+    t += bsprintf(t, "%02x", data->buf[i]);
 
   snprintf(buf, size, "0x%s", tmp);
 }
