fix off-by-one write copying snmp supply names

[aizu-m]

Checking the SNMP backend supply parser. The unknown-charset branch in backend_walk_cb carries a comment that the copy is safe because both buffers are CUPS_SNMP_MAX_STRING long. They are not:

object_value.string.bytes[CUPS_SNMP_MAX_STRING + 1]   // source, 1025
supplies[i - 1].name[CUPS_SNMP_MAX_STRING]            // dest, 1024

asn1_get_string can fill the source with 1024 non-nul bytes. A printer that reports an unknown character set and a 1024-byte prtMarkerSuppliesDescription then makes the loop copy 1024 chars and write the terminating nul one past name. Reproduced the exact loop with a canary:

ORIGINAL: nul written at name[1024] (slots 0..1023) -> out of bounds, color[0] 0x23 -> 0x00
FIXED   : nul written at name[1023] -> in bounds, color[0] 0x23

The other charset branches pass sizeof(supplies[0].name) and stay inside the buffer. Bounding the loop the same way keeps the nul in range.

[michaelrsweet]

We should just change the supply level name buffer to be size+1 as well.

[michaelrsweet]

[master 69dd78d] Increase supply name buffer by 1 byte (Issue #1604)

[2.4.x 483d780] Increase supply name buffer by 1 byte (Issue #1604)