Incorrect Buffer Size Calculation in Tinyexpr Leading to Process Crash

An incorrect buffer size calculation vulnerability exists in tinyexpr commit 4a7456e in new_expr(). For arity-0 expression nodes, including constants, variables, and zero-argument functions, the function allocates less memory than sizeof(te_expr) but treats the returned allocation as a complete te_expr object. This results in undefined behavior and can cause deterministic process termination in UBSan-instrumented builds.

Genann through 2018-07-08 has a SEGV in genann_run in genann.c.

Genann through 2018-07-08 has a stack-based buffer over-read in genann_train in genann.c.