fs: fix out-of-bounds write in mkdtemp for long prefixes

[frandle331-yh]

Mkdtemp() allocated the template buffer as length + strlen("XXXXXX"),
leaving no room for the terminating NUL byte that snprintf() writes. For
a single-byte prefix long enough to force the heap allocation path
(length + 6 > the stack-buffer threshold), snprintf() wrote the six 'X'
characters plus its NUL one byte past the end of the buffer -- a 1-byte
heap-buffer-overflow flagged by AddressSanitizer.

Allocate one extra byte for the NUL terminator, matching the + 1
already used by the sibling allocations in the same file.

Signed-off-by: frandle331-yh s1240100@gmail.com

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.16%. Comparing base (54a5095) to head (7bcec4a).
⚠️ Report is 7 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #64770      +/-   ##
==========================================
+ Coverage   90.14%   90.16%   +0.02%     
==========================================
  Files         744      744              
  Lines      242518   242518              
  Branches    45685    45696      +11     
==========================================
+ Hits       218611   218661      +50     
+ Misses      15396    15357      -39     
+ Partials     8511     8500      -11     

Files with missing lines	Coverage Δ
src/node_file.cc	74.26% <100.00%> (+0.07%)	⬆️

... and 33 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Renegade334]

This doesn't allocate the MaybeStackBuffer length correctly.

Rather than this mash of buffer/C-string styles, it would be better to copy the paradigm used eg. here:

  BufferValue tmpl(isolate, args[0]);
  const auto prefix_length = tmpl.length();
  static constexpr std::string_view suffix = "XXXXXX";
  tmpl.AllocateSufficientStorage(prefix_length + suffix.size() + 1);
  memcpy(tmpl.out() + prefix_length, suffix.data(), suffix.size());
  tmpl.SetLengthAndZeroTerminate(prefix_length + suffix.size());

[frandle331-yh]

Thanks! Updated to use the MaybeStackBuffer paradigm (memcpy + SetLengthAndZeroTerminate) as suggested, so the buffer length is set correctly rather than including the extra NUL byte.