fix heap over-read in cupsLangLoadStrings on trailing ';'

[tanjiroK-coder]

heap over-read in cupsLangLoadStrings on a trailing ;

reading the .strings parser i noticed the entry loop skips the ; with an explicit dataptr ++ and then the enclosing for (... ; *dataptr ; dataptr ++) steps past it a second time, so one byte after the ; is consumed without ever being looked at. when ; is the last byte of the catalog the explicit advance lands on the NUL and the loop increment then moves one past the malloc(st_size + 1) buffer, so *dataptr reads out of bounds and parsing runs on into adjacent heap until it trips over a NUL or a syntax error.

it is reachable from an untrusted printer: cups_load_localizations in dest-localization.c downloads the printer's printer-strings-uri to a temp file and hands it to cupsLangLoadStrings, and the in-memory cupsLangAddStrings path is exposed the same way. dropped the redundant advance so the loop increment alone consumes the ;; that also fixes a line-number off-by-one and a spurious syntax error when two pairs sit next to each other with no separator.

verified with a standalone asan reproducer: a ;-terminated buffer reports heap-buffer-overflow at language.c:326 before the change and loads cleanly after. testlang is green with the fix.

Assisted-by: Claude:claude-opus-4-8 [Claude Code]

[michaelrsweet]

Not going to amend the unit test for this...

Investigating...

[tanjiroK-coder]

fair enough, dropped the testlang change, so the PR is now just the one-line fix in language.c plus the CHANGES entry.

if it helps while you're looking: any .strings file whose last byte is ; with no trailing newline trips it, and under asan it shows up as a one-byte heap-buffer-overflow read on the *dataptr test in the for loop.

[michaelrsweet]

[master fc1288e] Fix potential string overrun in cupsLangLoadStrings (Issue #171)

(also pushed similar fixes to PAPPL and StringsUtil)