See how libconfini compares to other vendors in security performance
libconfini 1.16.4 contains a heap out-of-bounds write condition involving the bundled loadinibuffer.h utility and stripinicache(). The bundled utility allocates exactly inilength bytes, while stripinicache() unconditionally writes a NUL terminator at inisource[inilength], requiring an additional writable byte. Applications using the bundled allocation pattern can trigger deterministic heap memory corruption when processing any non-empty INI input, resulting in denial of service.