screen: fix the use of strncpy when using -X

SendCmdMessage in attacher.c used strncpy with increasing pointers into
the same buffer without reducing the available buffer size.
As the length is computed and checked already, use memcpy.
If the check fails, fail the operation instead of silent truncation of
the arguments sent.

Co-authored-by: Reno Dakota <paparodeo@proton.me>

Fixes: #384835

Related to: https://savannah.gnu.org/bugs/index.php?66215
Related to: https://savannah.gnu.org/bugs/index.php?66142

pkgs/tools/misc/screen/buffer-overflow-SendCmdMessage.patch

@@ -0,0 +1,13 @@
+--- a/attacher.c	2025-02-24 20:15:31.701820351 +0100
++++ b/attacher.c	2025-02-24 20:17:05.893826559 +0100
+@@ -461,8 +461,8 @@
+ 		size_t len;
+ 		len = strlen(*av) + 1;
+ 		if (p + len >= m.m.command.cmd + ARRAY_SIZE(m.m.command.cmd) - 1)
+-			break;
++			Panic(0, "Total length of the command to send too large.\n");
+-		strncpy(p, *av, MAXPATHLEN);
++		memcpy(p, *av, len);
+ 		p += len;
+ 	}
+ 	*p = 0;

pkgs/tools/misc/screen/default.nix

@@ -26,6 +26,13 @@ stdenv.mkDerivation rec {
   # We need _GNU_SOURCE so that mallocmock_reset() is defined: https://savannah.gnu.org/bugs/?66416
   NIX_CFLAGS_COMPILE = lib.optionalString (stdenv.cc.isGNU) "-D_GNU_SOURCE=1 -Wno-int-conversion -Wno-incompatible-pointer-types";
 
+  patches = [
+    # GNU Screen 5.0 uses strncpy incorrectly in SendCmdMessage
+    # This causes issues detected when using -D_FORTIFY_SOURCE=3
+    # e.g. https://savannah.gnu.org/bugs/index.php?66215
+    ./buffer-overflow-SendCmdMessage.patch
+  ];
+
   nativeBuildInputs = [
     autoreconfHook
   ];