Summary: __pmLogLoadInDom() contains bounds check that prevents a string index (idx)
from exceeding the buffer, but this check is guarded by if (acp != NULL). In the streaming
path used by the logger servlet (POST /logger/meta), acp is always NULL (hardcoded at the
call site), so the check never executes. An attacker can submit a TYPE_INDOM record with an
arbitrary idx value causing namelist[i] to point to any heap offset, which is subsequently
dereferenced by strlen/strdup in the caller, triggering a crash or enabling heap information
leakage.
Prerequisites: pmproxy reachable on TCP 44322 (default). A valid archive ID obtained from
a prior POST /logger/label (no authentication required for either request).