When a cascaded WMS server returns an XML exception, msDrawWMSLayerLow copies the response into a fixed szBuf with strlcpy(szBuf, result_data, MS_BUFFER_LENGTH). result_data is assembled in msHTTPWriteFct by memcpy of exactly result_size bytes and is never NUL-terminated (the +10000 slack from msSmallMalloc is uninitialized heap). strlcpy scans the source for a NUL to compute its length, so it walks past result_size into uninitialized or adjacent heap, and those bytes then land in the msSetError/msDebug message. A malicious or compromised upstream server sending a NUL-free text/xml body on the default in-memory path triggers it.

Copy result_size bytes and terminate explicitly, the way the sibling result_data consumers a few lines down already do. Keeping the length bound at the copy site is the only place that knows the real byte count, since the buffer past result_size is not part of the response.