`ccv_bfloat_to_double` 实现不正确

Hi, it looks like `ccv_bfloat_to_double` is implemented incorrectly. Specifically, this is the current implementation: https://GitHub.com/liuliu/ccv/blob/a1a8e06afe7d40d1f053f494da602f9a72c41617/lib/ccv_util.c#L1819-L1830 Inside the loop, it always unconditionally accesses `h[1]` (i.e. the same element is repeatedly converted to a double), instead of indexing using the index variable (i.e. `h[i]`). For cases where there is only one element, this causes a buffer OOB read (see below testcase), but also this would likely cause functional issues. (found via automated fuzzing) **testcase.cpp** #include <cstdint> extern "C" { #include "/fuzz/install/include/ccv.h" } int main() { uint16_t b[1] = { 0x1234 }; double d[1]; ccv_bfloat_to_double(b, d, 1); // Triggers ASan OOB read in ccv_bfloat_to_double return 0; } **crash report** { "Date": "2025-09-29T02:18:53.599961+00:00", "Uname": "Linux 795a6a8d1cfb 5.15.0-156-generic #166-Ubuntu SMP Sat Aug 9 00:02:46 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux", "OS": "Ubuntu", "OSRelease": "22.04", "Architecture": "amd64", "ExecutablePath": "/tmp/tmpsldzq0as/reproducer", "ProcEnviron": [ "LIBAFL_EDGES_MAP_SIZE=800000", "PWD=/fuzz/workspace", "CXX=gf_libafl_cxx", "GRAPHFUZZ_USE_ASAN=1", "HOME=/root", "ASAN_OPTIONS=hard_rss_limit_mb=1024:detect_leaks=0", "TERM=xterm-256color", "SHLVL=1", "LD_LIBRARY_PATH=/fuzz/install/lib", "PATH=/root/.cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "CC=gf_libafl_cc", "DEBIAN_FRONTEND=noninteractive", "OLDPWD=/fuzz/src/lib", "_=/usr/local/bin/agfi" ], "ProcCmdline": "/tmp/tmpsldzq0as/reproducer", "Stdin": "", "ProcStatus": [], "ProcMaps": [], "ProcFiles": [], "NetworkConnections": [], "CrashSeverity": { "Type": "NOT_EXPLOITABLE", "ShortDescription": "stack-buffer-overflow(read)", "Description": "Stack buffer overflow", "Explanation": "The target reads data past the end, or before the beginning, of the intended stack buffer." }, "Stacktrace": [ " #0 0x5555556948d8 in ccv_bfloat_to_double /fuzz/src/lib/ccv_util.c", " #1 0x55555565c4d2 in main /tmp/tmpsldzq0as/reproducer.cpp:8:3", " #2 0x7ffff5619d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16", " #3 0x7ffff5619e3f in __libc_start_main csu/../csu/libc-start.c:392:3", " #4 0x5555555812f4 in _start (/tmp/tmpsldzq0as/reproducer+0x2d2f4) (BuildId: dd32829972587349cd60b31f65a72ede5f40cb37)" ], "Registers": {}, "Disassembly": [], "Package": "", "PackageVersion": "", "PackageArchitecture": "", "PackageDescription": "" }, "AsanReport": [ "==219==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffff3600022 at pc 0x5555556948d9 bp 0x7fffffffea10 sp 0x7fffffffea08", "READ of size 2 at 0x7ffff3600022 thread T0", " #0 0x5555556948d8 in ccv_bfloat_to_double /fuzz/src/lib/ccv_util.c", … ]