lib: snprintf_can_error_frame: document and check required buffer size

The helper functions for the error frame content added the return
values of snprintf() to the buffer offset without checking for
truncation. With a too small buffer the following 'len - n' calculation
wrapped around (size_t) and subsequent snprintf() calls could write
beyond the end of the buffer.

As the maximum output length is known, introduce CANERR_BUFFSZ in lib.h
with a description how the required buffer size is calculated and
return an empty string if the provided buffer is smaller. The only user
candump provides a buffer of more than 6000 bytes for this function.

Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>

lib.c

@@ -664,6 +664,7 @@ int snprintf_long_canframe(char *buf, size_t size, union cfu *cu, int view)
 	return offset;
 }
 
+/* check CANERR_BUFFSZ in lib.h when changing the error frame strings */
 static const char *error_classes[] = {
 	"tx-timeout",
 	"lost-arbitration",
@@ -844,6 +845,13 @@ int snprintf_can_error_frame(char *buf, size_t len, const struct canfd_frame *cf
 	if (!sep)
 		sep = defsep;
 
+	/* the size of the provided buffer has to fit CANERR_BUFFSZ (see lib.h) */
+	if (len < CANERR_BUFFSZ) {
+		if (len)
+			buf[0] = 0; /* empty terminated string */
+		return 0;
+	}
+
 	for (i = 0; i < (int)ARRAY_SIZE(error_classes); i++) {
 		mask = 1 << i;
 		if (class & mask) {