zdump/dfi_vmcoreinfo: Validate vmcoreinfo value length before memcpy

vmcoreinfo_item() copies a key's value string from the vmcoreinfo heap
blob into the caller's buffer using memcpy() without checking the source
length. The length is derived from the distance between the '=' separator
and the next '\n' (or '\0') in the blob, which is bounded only by the
total vmcoreinfo size. A crafted dump with a vmcoreinfo value >= 1024
bytes would overflow the buffer.
Additionally, the len parameter of vmcoreinfo_item() was declared UNUSED
and never checked.
Fix by computing val_len before the copy and returning -1 if val_len >= len.
Change len type from int to size_t, which is natural for a buffer size,
drops the need for a negativity guard, and makes the call site passing
sizeof(str) type-consistent.
Write directly into the caller's buf, instead of going through the
intermediate str[].
Replace two strchr() calls with a single strchrnul().

Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>

zdump/dfi_vmcoreinfo.h

@@ -10,7 +10,7 @@
 
 void dfi_vmcoreinfo_init(void);
 const char *dfi_vmcoreinfo_get(void);
-int dfi_vmcoreinfo_tag(char *str, int len, const char *sym);
+int dfi_vmcoreinfo_tag(char *str, size_t len, const char *sym);
 int dfi_vmcoreinfo_symbol(unsigned long *val, const char *sym);
 int dfi_vmcoreinfo_offset(unsigned long *offs, const char *sym);
 int dfi_vmcoreinfo_size(unsigned long *size, const char *sym);