Bugfix: SSM: Make buffers long enough to avoid overflows

- coinb2 was missing room for the trailing \0 byte
- In the rare event of an empty merkle link list, the length of the serialised list was being treated as -1

driver-stratum.c

@@ -119,10 +119,13 @@ bool stratumsrv_update_notify_str(struct pool * const pool, bool clean)
 	size_t coinb2_len = bytes_len(&swork->coinbase) - swork->nonce2_offset - n2size;
 	size_t coinb2_lenx = coinb2_len * 2;
 	sprintf(my_job_id, "%"PRIx64"-%"PRIx64, (uint64_t)time(NULL), _ssm_jobid++);
-	size_t bufsz = 166 + strlen(my_job_id) + coinb1_lenx + coinb2_lenx + (swork->merkles * 67);
+	// NOTE: The buffer has up to 2 extra/unused bytes:
+	// NOTE: - If clean is "true", we spare the extra needed for "false"
+	// NOTE: - The first merkle link does not need a comma, but we cannot subtract it without breaking the case of zero merkle links
+	size_t bufsz = 24 /* sprintf 1 constant */ + strlen(my_job_id) + 64 /* prevhash */ + coinb1_lenx + coinb2_lenx + (swork->merkles * 67) + 49 /* sprintf 2 constant */ + 8 /* version */ + 8 /* nbits */ + 8 /* ntime */ + 5 /* clean */ + 1;
 	char * const buf = malloc(bufsz);
 	char *p = buf;
-	char prevhash[65], coinb1[coinb1_lenx + 1], coinb2[coinb2_lenx], version[9], nbits[9], ntime[9];
+	char prevhash[65], coinb1[coinb1_lenx + 1], coinb2[coinb2_lenx + 1], version[9], nbits[9], ntime[9];
 	uint32_t ntime_n;
 	bin2hex(prevhash, &swork->header1[4], 32);
 	bin2hex(coinb1, bytes_buf(&swork->coinbase), swork->nonce2_offset);