fix DEBUGASSERT logic + two minor issues

### I did this Found three issues while analyzing the code. None are exploitable but they're real bugs. --- ## 1. DEBUGASSERT uses OR instead of AND (`src/tool_help.c:169`) ```c DEBUGASSERT((ctx->elen < sizeof(ctx->rbuf)) || (ctx->flen < sizeof(ctx->rbuf))); ``` Should be AND — with OR, one value can exceed `rbuf[40]` and the corresponding `memmove` at line 190 or 200 will read out of bounds. Also `tlen` is unchecked. Fix: ```c DEBUGASSERT((ctx->tlen < sizeof(ctx->rbuf)) && (ctx->elen < sizeof(ctx->rbuf)) && (ctx->flen < sizeof(ctx->rbuf))); ``` --- ## 2. NULL passed to `%s` before check (`src/tool_operhlp.c:221-226`) ```c *filename = curlx_strdup("curl_response"); warnf("No remote filename, uses \"%s\"", *filename); // before NULL check // ... if(!*filename) return CURLE_OUT_OF_MEMORY; ``` If `curlx_strdup` fails, NULL goes to `%s` — undefined behavior. Move the NULL check before `warnf`. --- ## 3. `size_t` → `unsigned int` truncation (`projects/OS400/os400sys.c:384, 448`) ```c unsigned int i = inp->length; // truncates size_t in.value = malloc(i + 1); // overflows if i == UINT_MAX ``` Not reachable in practice (would need a 4GB GSSAPI token), but the truncation is a latent bug. Adding a bounds check before the cast would be correct. --- ### I expected the following Correct bounds checking and no undefined behavior. ### curl/libcurl version ``` curl 8.18.0 (x86_64-pc-linux-gnu) libcurl/8.18.0 Release-Date: 2025-01-08 ``` ### operating system ``` Linux 6.8.5-301.fc40.x86_64 x86_64 GNU/Linux ```