fix(svc): add bounds check before memcpy/strncpy in dump_pool_info handler

When processing isc_info_svc_dump_pool_info, the SPB clumplet's
declared length (length2) comes from the network and is only validated
against the destination buffer (fname).  However, the source pointer
(items) is not checked against the SPB buffer end (end_items/end_items2).

An attacker with service API access can craft an SPB where the clumplet
length claims more data than the remaining buffer, causing memcpy or
strncpy to read past the SPB buffer boundary.

Add bounds checks in both Service::query() and Service::query2() to
set length2 to zero when the declared length would exceed the buffer.

Author: Pyolar

src/jrd/svc.cpp

@@ -1257,6 +1257,10 @@ ISC_STATUS Service::query2(thread_db* /*tdbb*/,
 				if (length2 >= sizeof(fname))
 					length2 = sizeof(fname) - 1; // truncation
 				items += sizeof(USHORT);
+
+				if (items >= end_items || items + length2 > end_items)
+					length2 = 0;
+
 				strncpy(fname, (const char*) items, length2);
 				fname[length2] = 0;
 				break;
@@ -1711,6 +1715,10 @@ void Service::query(USHORT			send_item_length,
 				if (length2 >= sizeof(fname))
 					length2 = sizeof(fname) - 1; // truncation
 				items += sizeof(USHORT);
+
+				if (items >= end_items2 || items + length2 > end_items2)
+					length2 = 0;
+
 				memcpy(fname, items, length2);
 				fname[length2] = 0;
 				break;