Bug: ASSIMP Stack Buffer Overflow Vulnerability in ConvertName Function

## Vulnerability Summary

During fuzzing, a critical stack buffer overflow vulnerability has been discovered in the Open Asset Import Library (Assimp). The vulnerability occurs in the `ConvertName` function within `AssxmlFileWriter.cpp` at lines 115 and 118, triggered during XML dump operations. This leads to a stack buffer overflow that can cause memory corruption and program crash.

## Technical Details

- **Vulnerability Type**: Stack Buffer Overflow
- **Affected Function**: `Assimp::AssxmlFileWriter::ConvertName`
- **Source File**: `AssxmlFileWriter.cpp`
- **Line Numbers**: 115:36 and 118:26
- **Signal**: SIGABRT (6)

## Vulnerability Mechanism and Root Cause

This stack buffer overflow vulnerability is caused by insufficient bounds checking in the string conversion logic during XML export operations. The root issue lies in the `ConvertName` function where the program attempts to write beyond the allocated stack buffer boundaries when processing node names.

The vulnerability occurs when:
1. The assimp tool processes a malformed 3D model file during dump operations
2. The `WriteNode` function calls `ConvertName` to process node names for XML output
3. `ConvertName` attempts to write data to a stack-allocated buffer `name` with bounds [608, 1636)
4. The write operation occurs at offset 1636, which is exactly at the boundary, causing a 1-byte overflow

This creates a classic stack buffer overflow condition where the program writes past the end of a stack-allocated buffer, potentially overwriting adjacent stack variables and causing memory corruption.

## AddressSanitizer Report

```
=================================================================
==3027798==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffc7b38ba24 at pc 0x0000006ab0fc bp 0x7ffc7b38b360 sp 0x7ffc7b38b358
WRITE of size 1 at 0x7ffc7b38ba24 thread T0
#0 0x6ab0fb in Assimp::AssxmlFileWriter::ConvertName(aiString&, aiString const&) /fuzz/project/assimp/code/AssetLib/Assxml/AssxmlFileWriter.cpp:115:36
#1 0x6aa117 in Assimp::AssxmlFileWriter::WriteNode(aiNode const*, Assimp::IOStream*, unsigned int) /fuzz/project/assimp/code/AssetLib/Assxml/AssxmlFileWriter.cpp:132:5
#2 0x6aa760 in Assimp::AssxmlFileWriter::WriteNode(aiNode const*, Assimp::IOStream*, unsigned int) /fuzz/project/assimp/code/AssetLib/Assxml/AssxmlFileWriter.cpp:161:13
#3 0x6a2419 in Assimp::AssxmlFileWriter::WriteDump(char const*, char const*, aiScene const*, Assimp::IOStream*, bool) /fuzz/project/assimp/code/AssetLib/Assxml/AssxmlFileWriter.cpp:228:5
#4 0x6a1578 in Assimp::DumpSceneToAssxml(char const*, char const*, Assimp::IOSystem*, aiScene const*, bool) /fuzz/project/assimp/code/AssetLib/Assxml/AssxmlFileWriter.cpp:657:5
#5 0x53efa1 in Assimp_Dump(char const* const*, unsigned int) /fuzz/project/assimp/tools/assimp_cmd/WriteDump.cpp:153:13
#6 0x536435 in main /fuzz/project/assimp/tools/assimp_cmd/Main.cpp:228:10

Address 0x7ffc7b38ba24 is located in stack of thread T0 at offset 1636 in frame
#0 0x6a9dbf in Assimp::AssxmlFileWriter::WriteNode(aiNode const*, Assimp::IOStream*, unsigned int) /fuzz/project/assimp/code/AssetLib/Assxml/AssxmlFileWriter.cpp:123

This frame has 2 object(s):
[32, 544) 'prefix' (line 124)
[608, 1636) 'name' (line 131) <== Memory access at offset 1636 overflows this variable

SUMMARY: AddressSanitizer: stack-buffer-overflow /fuzz/project/assimp/code/AssetLib/Assxml/AssxmlFileWriter.cpp:115:36 in Assimp::AssxmlFileWriter::ConvertName(aiString&, aiString const&)
```

## Call Chain Analysis

The vulnerability is triggered through the following execution path:
1. **main** → **Assimp_Dump** (command line dump operation)
2. **Assimp_Dump** → **DumpSceneToAssxml** (XML export function)
3. **DumpSceneToAssxml** → **WriteDump** → **WriteNode** (node processing)
4. **WriteNode** → **ConvertName** (vulnerable function with stack buffer overflow)

The recursive nature of `WriteNode` (line 161 calls itself) suggests this occurs during scene graph traversal, making it triggerable with deeply nested or specially crafted 3D model structures.

## Proof of Concept

The vulnerability can be triggered by processing the malformed 3D model file provided as `POC_assimp_stack_buffer_overflow_convertname_assxml`. This file contains specific model structures that cause the stack buffer overflow condition during XML dump operations.

**POC Download**: [Google Drive Link - POC_assimp_stack_buffer_overflow_convertname_assxml](https://drive.google.com/file/d/1z5NaL2BhIlFXg_UpReIjO8FJyGiHUXAI/view?usp=sharing)

## Reproduction Steps

1. Compile assimp with AddressSanitizer enabled
2. Execute: `assimp dump POC_assimp_stack_buffer_overflow_convertname_assxml`
3. The program will crash with a stack-buffer-overflow error

## Affected Versions

The Newest Master. Open Asset Import Library ("Assimp") Version 6.0 -debug -st (GIT commit db0bde75) from https://github.com/assimp/assimp

**Credit**
- Xudong Cao (UCAS)
- Yuqing Zhang (UCAS, Zhongguancun Laboratory)

Start in code/AssetLib/Assxml/AssxmlFileWriter.cpp, especially ConvertName and its calls from WriteNode. Build Assimp with AddressSanitizer and reproduce with `assimp dump POC_assimp_stack_buffer_overflow_convertname_assxml`. Done means the malformed model no longer produces the reported stack-buffer-overflow during XML dump operations.

Written by the indexing model from the issue text.