fix stack underflow in ippAddStringfv/ippSetStringfv truncation

[aizu-m]

Turned up while fuzzing the string constructors with malformed UTF-8.

AddressSanitizer, testipp calling ippAddStringf() with a value that is all 0x80 continuation bytes and a length-limited tag:

==ERROR: AddressSanitizer: stack-buffer-underflow, WRITE of size 1
    #0 ippAddStringfv ipp.c:1098
    #1 ippAddStringf  ipp.c:960
    #2 main           testipp.c:906
'buffer' (line 1008) <== Memory access at offset 31 underflows this variable
SUMMARY: stack-buffer-underflow ipp.c:1098 in ippAddStringfv

When an over-long value is trimmed to the tag maximum at a UTF-8 boundary, the inner loop that skips continuation bytes is bounded by bufptr > buffer, but the outer bufptr -- that follows it is not. A value whose first max_bytes bytes are all continuation bytes (no lead byte) walks bufptr down to buffer, the outer decrement then drops it to buffer - 1, the while (bufptr > bufmax) exits, and *bufptr = '\0' stores one byte below the array. As a side effect the value is also left untrimmed.

ippSetStringfv carries the same block, so both get the guard. It only mirrors what the inner loop already does. Added a testipp case that fails before the change (value not trimmed) and passes after.

[michaelrsweet]

Investigating...

(Please use your GPG key to sign commits for this repository...)

[aizu-m]

Re-pushed the same commit signed with my GPG key, shows as verified now. No code changes, just the signature.

[michaelrsweet]

Good on libcups changes, don't want the unit test noise.

[michaelrsweet]

[master 6f30dcc] Fix potential buffer underflow issue in ippAdd/SetStringf(v) (Issue #1664)

[2.4.x 76bac38] Fix potential buffer underflow issue in ippAdd/SetStringf(v) (Issue #1664)