daemon: fix OOB read and parse bug in dlt_daemon_control_get_log_info_v2 (closes #870)

[SoundMatt]

Problem

dlt_daemon_control_get_log_info_v2 had two compounding bugs, each
addressed by one commit in this PR.

1. Out-of-bounds read parsing apidlen / ctidlen

The fixed-size precheck only validated the 11-byte minimum
GET_LOG_INFO V2 request before the function read two attacker-
controlled uint8_t length fields (apidlen, ctidlen) and used
them to advance an offset into msg->databuffer. A short message
with non-zero length fields caused the variable-length reads to walk
past the end of msg->databuffer (up to ~514 bytes). Reachable from
any client able to talk to the daemon's control socket. Bounded OOB
read; no OOB write.

2. Function never actually parses apid / ctid (#870)

req is calloc'd, so its char *apid / char *ctid pointer fields
start NULL. The dlt_set_id_v2(req->apid, ...) calls intended to
populate them are no-ops (the helper early-returns when its
destination is NULL). req->apid / req->ctid therefore stayed
NULL and were passed to dlt_daemon_application_find_v2 /
dlt_daemon_context_find_v2 with non-zero corresponding lengths —
turning every non-empty apid / ctid lookup into a zero-length one.
Full analysis in #870.

Fix

Two commits:

1. Bounds checks after each variable-length field is parsed,
   freeing the calloc'd req and returning when the message cannot
   satisfy the next read.
2. Replace the no-op dlt_set_id_v2(req->apid, ...) calls with
   conditional pointer assignments into msg->databuffer,
   mirroring the surgical approach taken for set_log_level_v2 in
   daemon: parse apid/ctid in dlt_daemon_control_set_log_level_v2 #864 and unregister_context_v2 in daemon: fix multi-bug response builder in dlt_daemon_control_message_unregister_context_v2 (closes #867) #868.

req shares storage with the message buffer for the duration of
this function call, so the pointer-into-databuffer assignments are
lifetime-safe.

Notes

• Together with daemon: parse apid/ctid in dlt_daemon_control_set_log_level_v2 #864, daemon: fix multi-bug response builder in dlt_daemon_control_message_unregister_context_v2 (closes #867) #868, and daemon: parse incrementally in dlt_daemon_control_set_trace_status_v2 (V2 control-handler family, ref #866) #869, this completes the V2
  control-handler family cleanup enumerated in Multiple V2 control-message handlers are broken by char* fields in protocol structs (set_log_level_v2 [#863], set_trace_status_v2, unregister_context_v2, get_log_info_v2) #866.
• The function has pre-existing leak paths on other early returns
  (the calloc'd req is freed only on the normal exit ~line 2532).
  Not addressed here to keep scope focused — could be a separate
  cleanup PR.

Closes #870.
Related: #866 (META).

[minminlittleshrimp]

Please signoff in your commit

[SoundMatt]

Done — added Signed-off-by to both commits (force-pushed).

While here I also reworked the apid/ctid parsing to use the shared dlt_set_id_v2() helper into local char[DLT_V2_ID_SIZE] buffers instead of aliasing the receive buffer, matching the approach taken in #864/#868 (the struct's apid/ctid are char *, so the original dlt_set_id_v2(req->apid, …) was a no-op against a NULL destination). The OOB bounds checks are unchanged; the buffers live for the whole function scope and req is freed (struct only) before return, so the pointers stay valid for every use.