fix stack overflow in ExpandLinks path component parsing

[aizu-m]

Found this reading the symlink resolver.

1. ExpandLinks() splits the path one component at a time with sscanf(sp, "%[^/]", node) into node[CF_MAXLINKSIZE] (256), no field width.

2. the parse runs before the lstat(), and the recursive call hands readlink() targets (up to CF_BUFSIZE-1) back in as from, so a symlink target that is a single long slash-free component overruns the stack.

    ERROR: AddressSanitizer: stack-buffer-overflow
        WRITE of size 1023
        #1 sscanf
        #2 ExpandLinks files_links.c:710
   

Measured the component with strcspn() first and bail the same way the rest of the function already does on an over-long path. Regression test added under tests/unit.

[cf-bottom]

Thanks for submitting a pull request! Maybe @larsewi can review this?

[larsewi]

@cf-bottom Jenkins please :)

[cf-bottom]

Sure, I triggered a build:

Jenkins: https://ci.cfengine.com/job/pr-pipeline/14180/

Packages: http://buildcache.cfengine.com/packages/testing-pr/jenkins-pr-pipeline-14180/

[larsewi]

Please squash the two commits and rebase :)

[aizu-m]

Done, squashed into one commit and rebased onto latest master.

[larsewi]

@cf-bottom Jenkins please :)

[cf-bottom]

Alright, I triggered a build:

Jenkins: https://ci.cfengine.com/job/pr-pipeline/14205/

Packages: http://buildcache.cfengine.com/packages/testing-pr/jenkins-pr-pipeline-14205/