screen: fix the use of strncpy when using -X (#384846)

pkgs/tools/misc/screen/buffer-overflow-SendCmdMessage.patch

@@ -0,0 +1,13 @@
+--- a/attacher.c	2025-02-24 20:15:31.701820351 +0100
++++ b/attacher.c	2025-02-24 20:17:05.893826559 +0100
+@@ -461,8 +461,8 @@
+ 		size_t len;
+ 		len = strlen(*av) + 1;
+ 		if (p + len >= m.m.command.cmd + ARRAY_SIZE(m.m.command.cmd) - 1)
+-			break;
++			Panic(0, "Total length of the command to send too large.\n");
+-		strncpy(p, *av, MAXPATHLEN);
++		memcpy(p, *av, len);
+ 		p += len;
+ 	}
+ 	*p = 0;

pkgs/tools/misc/screen/default.nix

@@ -26,6 +26,13 @@ stdenv.mkDerivation rec {
   # We need _GNU_SOURCE so that mallocmock_reset() is defined: https://savannah.gnu.org/bugs/?66416
   NIX_CFLAGS_COMPILE = lib.optionalString (stdenv.cc.isGNU) "-D_GNU_SOURCE=1 -Wno-int-conversion -Wno-incompatible-pointer-types";
 
+  patches = [
+    # GNU Screen 5.0 uses strncpy incorrectly in SendCmdMessage
+    # This causes issues detected when using -D_FORTIFY_SOURCE=3
+    # e.g. https://savannah.gnu.org/bugs/index.php?66215
+    ./buffer-overflow-SendCmdMessage.patch
+  ];
+
   nativeBuildInputs = [
     autoreconfHook
   ];