fix: (system) Fix buffer overflow in stdlib_get_cwd and improve const correctness

[JAi-SATHVIK]

Motivation

The C implementation of stdlib_get_cwd in src/stdlib_system.c contained a critical buffer overflow vulnerability (Security Issue).

• malloc(*len) allocated memory exactly equal to the string length, leaving no space for the null terminator.
• strncpy was used without manually adding the null terminator, which could lead to undefined behavior when the string is used later.
• There was no check for malloc failure, which could cause a crash if memory allocation failed.

Additionally, stdlib_set_cwd accepted a non-const char* even though it does not modify the path, violating const correctness.

Solution

1. Fix Buffer Overflow: Allocated *len + 1 bytes in stdlib_get_cwd to ensure space for the null terminator.
2. Explicit Null Termination: Added res[*len] = '\0' to guarantee the string is valid.
3. Error Handling: Added a check for malloc returning NULL and set the error code to ENOMEM in that case.
4. Const Correctness: Updated stdlib_set_cwd signature to accept const char* path.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.57%. Comparing base (572c289) to head (ba5fff7).

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1078      +/-   ##
==========================================
- Coverage   68.59%   68.57%   -0.03%     
==========================================
  Files         393      393              
  Lines       12710    12710              
  Branches     1377     1377              
==========================================
- Hits         8719     8716       -3     
- Misses       3991     3994       +3     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.