fix: harden strcat overflow and unchecked fwrite in model save

[tombudd]

Summary

Two minimal C safety hardening fixes found by UNA (autonomous security auditor, designed and built by Tom Budd — tom@tombudd.com):

1. Buffer overflow in ui_main.c — strcat → mjSTRNCAT

File: src/ui/ui_main.c:1897

shortcuthelp() concatenates a modifier string and a key name into a 50-byte stack buffer using bare strcat(text, key). If key is sufficiently long, this overflows text[50].

Fix: Replace with mjSTRNCAT(text, key) — MuJoCo's own bounds-checked macro, already defined in engine_array_safety.h (which is already #included in this file) and already used elsewhere in the same file (lines 1007, 1009 use strncat with explicit size).

2. Silent data corruption in engine_io.c — unchecked fwrite errors

File: src/engine/engine_io.c — mj_saveModel()

mj_saveModel() writes the entire model via multiple fwrite() calls, then calls fclose(fp) without ever checking ferror(fp). If any write fails (disk full, I/O error, NFS timeout), the function returns silently, leaving a truncated/corrupt .mjb file on disk with no indication of failure.

Fix: Add ferror(fp) check before fclose(fp), calling mju_warning() (MuJoCo's own warning mechanism) if the stream is in an error state.

Changes

File	Change	Lines
src/ui/ui_main.c	strcat → mjSTRNCAT	+1 / -1
src/engine/engine_io.c	Add ferror(fp) + mju_warning()	+3 / -0

Total: 2 files, +4 / -1 lines

Why these fixes matter

• Both follow existing MuJoCo conventions — no new patterns or dependencies introduced
• Both are on success-path-transparent: zero behavioral change when nothing goes wrong
• The strcat fix closes a stack buffer overflow (potential code execution in adversarial scenarios)
• The ferror fix prevents silent model corruption that could cause hard-to-diagnose simulation failures downstream

About This Review

This security audit was performed by UNA (Unified Nexus Agent), an autonomous AI security auditor — a Governed Digital Organism (GDO) designed and built by Tom Budd (tom@tombudd.com | tombudd.com).

UNA conducts comprehensive codebase audits covering memory safety, input validation, error handling, and C-specific vulnerability patterns. All findings are human-verified before submission.

Note: I understand Google requires a CLA signature for contributions — happy to complete that at cla.developers.google.com if needed.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.