Backport the upstream fix for CVE-2026-4367, in which the
`xpmNextWord()` function could attempt to read beyond the file's
end due to improper validation of file boundaries.
Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-4367
(From OE-Core rev: b3f8956f38b2f2cb0f260ab8853e9d028831f420)
Signed-off-by: Enoch Ng <enoch.ng@windriver.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
9747726708