fix: memory-safety and polling correctness backports for 1.2.x

[somethingwithproof]

Backports the memory-safety, process-lifecycle, and polling-correctness fixes identified in the 1.2.x review.

Memory safety and resource handling:

• fix the strncopy one-byte overflow and keep its scan portable to older Solaris
• reserve the php_readpipe terminator byte, enforce one aggregate response/startup deadline, and recycle a server whose partial or oversized response leaves unread protocol data
• keep log newline appends inside flogmessage and initialize the buffer before strftime
• free settings-query results on missing rows and check allocation results before dereference
• preserve allocation ownership when trimming recache command output

Process and privilege lifecycle:

• send quit to every PHP server before a shared grace period, then signal/reap in parallel rounds with bounded SIGTERM-to-SIGKILL escalation
• normalize SIGCHLD to SIG_DFL, verify retained children with waitpid before signaling, and prevent active slots from overwriting unreaped PIDs
• bound failed-server restart churn and make every no-server caller return U
• block SIGPIPE only around complete script-server writes and consume only a newly generated pending signal
• create pipe/socket descriptors close-on-exec, using pipe2/SOCK_CLOEXEC when available and a serialized fallback otherwise
• serialize vfork, optional libc popen, and the complete process-wide euid-0 raw-socket window so data-input children cannot inherit root
• remove unnecessary privilege elevation when closing raw sockets and fail closed if privileges cannot be dropped

Polling correctness:

• preserve complete database hostnames, including bare IPv6 literals. The removed host:port parser was dead: callers do not consume its method/port outputs and overwrite those fields from the database, while tokenizing the hostname truncated valid IPv6 input.
• validate IPv4 and ICMP header lengths before access, consume rejected peeked datagrams, and correlate echo replies by host, type, identifier, and sequence
• make snmp_count stop on internal Net-SNMP errors, distinguish SNMPv1 noSuchName walk completion, and avoid turning internal errors into valid zero counts
• fail closed when device/item-count rows cannot be fetched, preventing zero counts from becoming unbounded duplicate polls
• make CLI fatal paths return failure and guard nullable database row fields

Verification:

• ./bootstrap completes (using Homebrew glibtoolize; the initial unavailable GNU libtoolize probe is non-fatal)
• default configure/build succeeds against Homebrew mysql-client, net-snmp, and OpenSSL 3
• --enable-popen configure/build also succeeds
• both builds use --enable-warnings and make -j4; remaining warnings are pre-existing macOS deprecations and unrelated unused variables
• git diff --check passes
• the blocking pre-push review gate passes all stages (critical/high, secondary scanners, medium, and missing-test review)

Scope notes:

• The new close-on-exec handling covers descriptors created by the changed PHP/script/ICMP paths. Existing MySQL, log, and Net-SNMP descriptors do not yet have comprehensive close-on-exec coverage; that broader descriptor audit should be a separate change rather than implied by this backport.
• In the non-default --enable-popen mode, the existing timeout path intentionally skips pclose and can retain a child until it exits. This PR secures that mode's fork against the euid window but does not redesign its legacy timeout ownership.
• Spine has no in-tree C test harness. The failure-mode paths were statically reviewed and both supported build variants were compiled, but deployment validation should still exercise PHP restart/orphan handling, partial-response timeouts, SNMPv1 count behavior, and malformed/foreign ICMP replies.

[somethingwithproof]

Rolled in the 1.2.x half of three more bugs that are present on both branches, so this is now seven fixes rather than four. Still 0 warnings, matching the 1.2.x baseline.

• issue#564: the four unchecked calloc() results in spine.c, dereferenced on the next statement
• issue#565: strcat() wrote the log newline one byte past flogmessage once the message filled LOGSIZE
• issue#566: MYSQL_RES leaked on the no-row branch of four settings helpers

The develop half of the same three is #576.

[Copilot]

🟡 Changes recommended

There are remaining correctness/portability issues in php.c (inconsistent BUFSIZE vs RESULTS_BUFFER bounds check and an unguarded usleep() relative to existing SOLAR_THREAD handling) that should be resolved before merging.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR backports several small, independent fixes from develop to the 1.2.x maintenance branch, primarily addressing memory-safety issues (off-by-one/overflow) and shutdown correctness in the PHP script-server path.

Changes:

• Harden string/buffer handling (strncopy(), php_readpipe(), and log newline appending) to prevent out-of-bounds writes.
• Improve correctness and thread-safety in hostname parsing (get_namebyhost() uses proper copy + strtok_r).
• Ensure resources/processes are cleaned up (free MySQL result sets on empty fetch paths; reap script-server children on shutdown).

File summaries

File	Description
util.c	Fix result-set leaks in settings helpers; make spine_log() newline append bounded; fix strncopy() off-by-one/OOB behavior and remove warning-suppression pragmas.
spine.h	Reduce remote DB SSL path buffers to BUFSIZE to match config parsing limits and avoid misleading copy bounds.
spine.c	Add fatal checks for several calloc() allocations before dereference.
ping.c	Fix hostname copying so parsing is reachable; switch to strtok_r for reentrant tokenization.
php.c	Reserve NUL terminator space in php_readpipe(); add bounded shutdown/reap logic for script-server processes.
CHANGELOG	Document the backported fixes for 1.2.32.

Review details

• Files reviewed: 6/6 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[somethingwithproof]

@copilot Fix the code for all comments in this review thread.

When a review comment includes a suggested change, apply the suggestion exactly.

Do not make changes beyond what is described in the linked review thread.

[somethingwithproof]

Updated the consolidated backport through commit 9d05e4e after the full review cycle. The final pre-push verdict is PASS: all critical/high, secondary, medium, and missing-test scans are clean. I also built both the default nft_popen configuration and the supported --enable-popen configuration against Homebrew mysql-client, net-snmp, and OpenSSL 3. The PR body now documents the parser rationale, build evidence, and the remaining pre-existing descriptor/popen scope limitations.

[bmfmancini]

LGTM — reviewed the memory-safety and polling correctness backports (strncopy overflow fix, php_readpipe terminator handling, SIGCHLD/fork serialization, close-on-exec descriptors, ICMP validation, snmp_count fail-closed paths). Approving.