blob: use size_t for blob_memdup() length

blob_pad_len() returns size_t and the value is used as a memory
allocation/copy size. Storing it in a signed int could truncate or
turn the value negative on platforms or inputs where the padded
length exceeds INT_MAX, leading to a too-small malloc() and an
out-of-bounds memcpy().

Link: https://github.com/openwrt/libubox/pull/42
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 02fccb465651f470ddd988f60036f22e485b5ac8)

1 files changed, 1 insertions, 1 deletions

diff --git a/blob.c b/blob.c
index 3c2dd81..93321ed 100644
--- a/blob.c
+++ b/blob.c
@@ -338,7 +338,7 @@ struct blob_attr *
 blob_memdup(const struct blob_attr *attr)
 {
 	struct blob_attr *ret;
-	int size = blob_pad_len(attr);
+	size_t size = blob_pad_len(attr);
 
 	ret = malloc(size);
 	if (!ret)