CVE-2026-90781 — alsa-lib OOB Write Reproducer

Standalone C reproducer for CVE-2026-90781, a 1-byte out-of-bounds write in alsa-lib's __snd_ctl_ascii_elem_id_parse() when parsing name= (both quoted and unquoted forms).

Vulnerability

In src/control/ctlparse.c (v1.2.16.1 and earlier development HEAD):

char buf[64];
...
if (size < (int)sizeof(buf)) {   // BUG: allows size == 64
    *ptr++ = *str;
    size++;
}
...
*ptr = '\0';                     // writes buf[64] when size == 64

The numid= path was already fixed to sizeof(buf) - 1; the two name= loops were not.