patch 9.2.0498: potential heap buffer overflow in if_xcmdsrv.c

Problem:  potential heap buffer overflow in if_xcmdsrv.c
          server_parse_message() (Michael Bommarito)
Solution: Add strlen() call (Foxe Chen)

fixes:  #20235
closes: #20236

Signed-off-by: Foxe Chen <chen.foxe@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>

src/if_xcmdsrv.c

@@ -1333,7 +1333,7 @@ server_parse_message(
 
 			// Initialize the result property.
 			ga_init2(&reply, 1, 100);
-			(void)ga_grow(&reply, 50 + STRLEN(p_enc));
+			(void)ga_grow(&reply, 50 + STRLEN(p_enc) + STRLEN(serial));
 			sprintf(reply.ga_data, "%cr%c-E %s%c-s %s%c-r ",
 						   0, 0, p_enc, 0, serial, 0);
 			reply.ga_len = 14 + STRLEN(p_enc) + STRLEN(serial);

src/version.c

@@ -729,6 +729,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    498,
 /**/
     497,
 /**/