Fix: decrement past start of allocated memory in add_quoting

[mattmundell]

What

Change the decrement of a pointer to be the decrement of a length, in add_quoting in cpeutils.c.

Why

This was leading to aborts in gvmd SCAP rebuilds on my Asan builds (and might be leading to empty fields in the CPE structs).

tmp_component is created by g_strdup. Doing strlen on tmp_component - 1 is reading into arbitrary memory. It's likely generally safe due to malloc padding, but may result in the length being off (if the byte before tmp_component is NULL).

Pretty sure the intention was just to decrement the length after.

I've confirmed with a test and -fsantize=address. Before the patch there were Asan leak warnings in the log, after the patch the warnings are gone.

Checklist

• Tests

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 1b8d3b3.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Scanned Files

None