gstring: Fix g_string_append_vprintf overflow

The g_string_append_vprintf function could overflow with strings
which are INT_MAX bytes long. The eventual memcpy call copies INT_MAX
plus additional nul byte into newly allocated memory. This means
that due to signed integer overflow more bytes are copied than
could ever fit.

glib/gstring.c

@@ -1360,7 +1360,7 @@ g_string_append_vprintf (GString     *string,
   if (len >= 0)
     {
       g_string_maybe_expand (string, len);
-      memcpy (string->str + string->len, buf, len + 1);
+      memcpy (string->str + string->len, buf, (size_t) len + 1);
       string->len += len;
       g_free (buf);
     }