Bound SAS format suffix writes

[carrerasdarren-cell]

Summary

• keep SAS format width and digit suffix writes inside readstat_variable_t.format
• recompute the stored length after a potentially truncated width before appending digits

Root cause

snprintf() returns the number of bytes it wanted to write, even when the destination truncates the result. A near-full 256-byte format can therefore advance len past the array before the digit suffix is appended, producing an out-of-bounds pointer and an underflowed remaining size.

This fixes the publicly disclosed OSV-2026-634 / OSS-Fuzz issue 506459940. The exact testcase previously reported index 257 out of bounds for type char[256] in sas7bdat_init_variable().

Verification

• make check: 4/4 tests passed under ASan/UBSan
• exact OSS-Fuzz testcase 5180794695122944 (SHA-256 12128ef78252314bc605bc6c8236383caffff420be659e6b466b33dfb54e6136): clean under ASan/UBSan after the fix
• all 96 generated SAS7BDAT corpus files: clean under ASan/UBSan
• git diff --check