Merge pull request #3364 from stan-dev/pathfinder-oob-read

Avoid indexing past vector length in Pathfinder writer

Author: SteveBronder

src/stan/services/pathfinder/multi.hpp

@@ -343,11 +343,13 @@ inline int pathfinder_lbfgs_multi(
             sample_row.tail(uc_param_size) = approx_samples_constrained_col;
             safe_write(sample_row);
             // If we see the same draw idx more than once, just increment j and
-            // write again
-            while (j < (single_path_psis_idxs[i].second)
-                   && draw_idx == psis_draw_idxs.coeff(j + 1)) {
-              safe_write(sample_row);
-              ++j;
+            // write again if there are remaining draws
+            if (j < (psis_draw_idxs.size() - 1)) {
+              while (j < (single_path_psis_idxs[i].second)
+                     && draw_idx == psis_draw_idxs.coeff(j + 1)) {
+                safe_write(sample_row);
+                ++j;
+              }
             }
           }
         }