expr(fix): capacity overflow

[hlsxx]

The fix limits the memory allocation to the size of the input string.

Fixed: #12574

[sylvestre]

does this match the GNU behavior?

[hlsxx]

Hope so, the GNU tests for the expr implementation passed locally

[github-actions]

GNU testsuite comparison:

Skip an intermittent issue tests/date/date-locale-hour (fails in this run but passes in the 'main' branch)
Skip an intermittent issue tests/pr/bounded-memory (fails in this run but passes in the 'main' branch)
Skip an intermittent issue tests/tail/pid-pipe (fails in this run but passes in the 'main' branch)
Skipping an intermittent issue tests/date/resolution (passes in this run but fails in the 'main' branch)
Skipping an intermittent issue tests/tail/tail-n0f (passes in this run but fails in the 'main' branch)
Note: The gnu test tests/basenc/bounded-memory is now being skipped but was previously passing.
Note: The gnu test tests/rm/many-dir-entries-vs-OOM is now being skipped but was previously passing.
Congrats! The gnu test tests/printf/printf-surprise is now passing!

[codspeed-hq]

Merging this PR will degrade performance by 3.67%

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

⚡ 1 improved benchmark
❌ 3 regressed benchmarks
✅ 319 untouched benchmarks
⏩ 46 skipped benchmarks¹

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Mode	Benchmark	BASE	HEAD	Efficiency
❌	Memory	cp_recursive_deep_tree[(120, 4)]	562.5 KB	615.6 KB	-8.62%
❌	Simulation	ls_recursive_balanced_tree[(6, 4, 15)]	49.6 ms	52.3 ms	-5.21%
❌	Simulation	ls_recursive_wide_tree[(10000, 1000)]	33 ms	34.3 ms	-3.81%
⚡	Simulation	single_date_now	85.5 µs	82.7 µs	+3.34%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing hlsxx:expr-cap-overflow (cb6abbf) with main (4505d51)}

Footnotes

1. 46 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩