libexpr: Fix read out-of-bound on the heap

[Pamplemousse]

• When s contains \r\n, len does not get decremented enough, and so more looping than necessary happens;
• I replaced the while loop with a for because len is a size_t, thus decrementing it if its value is 0 would not stop the loop.

cc @regnat

Signed-off-by: Pamplemousse [email protected]

[edolstra]

This breaks some tests because it changes column/line numbers:

    evaluating lang/eval-okay-getattrpos-functionargs.nix (should succeed)
    1c1
    < { column = 1; file = "eval-okay-getattrpos-functionargs.nix"; line = 1; }
    ---
    > { column = 11; file = "eval-okay-getattrpos-functionargs.nix"; line = 2; }

[Pamplemousse]

Good thing there are tests, the conditional in the loop was broken 😅

[nixos-discourse]

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/tweag-fellowship-fuzzing-nix-2/14228/1

[nixos-discourse]

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/tweag-nix-dev-update-16/14379/1