diff -Nura pkgconf-1.8.0/libpkgconf/tuple.c pkgconf-1.8.0_new/libpkgconf/tuple.c

--- pkgconf-1.8.0/libpkgconf/tuple.c	2021-03-18 20:15:16.000000000 +0800

+++ pkgconf-1.8.0_new/libpkgconf/tuple.c	2023-01-30 16:07:40.750297141 +0800

@@ -293,12 +293,23 @@

 				}

 			}

+                        PKGCONF_TRACE(client, "lookup tuple %s", varname);

+

+                        size_t remain = PKGCONF_BUFSIZE - (bptr - buf);

 			ptr += (pptr - ptr);

 			kv = pkgconf_tuple_find_global(client, varname);

 			if (kv != NULL)

 			{

-				strncpy(bptr, kv, PKGCONF_BUFSIZE - (bptr - buf));

-				bptr += strlen(kv);

+                       	        size_t nlen = pkgconf_strlcpy(bptr, kv, remain);

+				if (nlen > remain)

+				{

+					pkgconf_warn(client, "warning: truncating very long variable to 64KB\n");

+

+					bptr = buf + (PKGCONF_BUFSIZE - 1);

+					break;

+				}

+

+				bptr += nlen;

 			}

 			else

 			{

@@ -306,12 +317,20 @@

 				if (kv != NULL)

 				{

+                                        size_t nlen;

+

 					parsekv = pkgconf_tuple_parse(client, vars, kv);

+                                        nlen = pkgconf_strlcpy(bptr, parsekv, remain);

+					free(parsekv);

-					strncpy(bptr, parsekv, PKGCONF_BUFSIZE - (bptr - buf));

-					bptr += strlen(parsekv);

+                                        if (nlen > remain)

+                                        {

+                                                pkgconf_warn(client, "warning: truncating very long variable to 64KB\n");

+                                                bptr = buf + (PKGCONF_BUFSIZE - 1);

+                                                break;

+                                        }

-					free(parsekv);

+                                        bptr += nlen;

 				}

 			}

 		}