node: bounds-check and OOM-guard in cmark_set_cstr

cmark_set_cstr backs every cmark string setter (cmark_node_set_url, _set_title, _set_literal, _set_fence_info, _set_on_enter, _set_on_exit). This change closes two paths to undefined behaviour:

1. The realloc result is not checked. mem->realloc can return NULL via stdlib OOM or a caller-supplied allocator (cmark exposes the allocator through cmark_node_new_with_mem). The next line dereferences it, so failure is UB inside memcpy rather than a defined abort.

2. The bufsize_t cast of strlen silently truncates. bufsize_t is int32_t; for strlen(src) > INT32_MAX the cast wraps and subsequent len + 1 and memcpy operate on a truncated count.

Both now abort() with a diagnostic, matching the existing precedent in cmark_strbuf_grow (src/buffer.c).

Co-Authored-By: Claude <noreply@anthropic.com>

Author: Alearner12

src/node.c

@@ -1,4 +1,6 @@
 #include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 
@@ -270,9 +272,23 @@ static bufsize_t cmark_set_cstr(cmark_mem *mem, unsigned char **dst,
   bufsize_t len;
 
   if (src && src[0]) {
-      len = (bufsize_t)strlen(src);
-      *dst = (unsigned char *)mem->realloc(NULL, len + 1);
-      memcpy(*dst, src, len + 1);
+      size_t srclen = strlen(src);
+      if (srclen > (size_t)(INT32_MAX - 1)) {
+        fprintf(stderr,
+                "[cmark] cmark_set_cstr: input exceeds %d bytes, aborting\n",
+                INT32_MAX - 1);
+        abort();
+      }
+      len = (bufsize_t)srclen;
+      unsigned char *buf =
+          (unsigned char *)mem->realloc(NULL, (size_t)len + 1);
+      if (buf == NULL) {
+        fprintf(stderr,
+                "[cmark] cmark_set_cstr: allocator returned NULL, aborting\n");
+        abort();
+      }
+      memcpy(buf, src, (size_t)len + 1);
+      *dst = buf;
   } else {
       len = 0;
       *dst = NULL;