Address code review feedback on security fixes

- Fix buffer size for strncpy to match actual buffer (32 bytes)
- Use strtoul instead of strtol for unsigned color values
- Improve strncat bounds checking with accurate length tracking
- Free wordexp results immediately after use instead of batching
- Add strdup for wordexp strings to avoid use-after-free

Co-authored-by: squassina <8495707+squassina@users.noreply.github.com>

src/dispatch/bind_define.h

@@ -837,15 +837,17 @@ int32_t spawn(const Arg *arg) {
 		// 2. 解析参数
 		char *argv[64];
 		int32_t argc = 0;
-		wordexp_t wordexp_results[63]; // Track all wordexp results for cleanup
-		int32_t wordexp_count = 0;
 		
 		char *token = strtok((char *)arg->v, " ");
 		while (token != NULL && argc < 63) {
 			wordexp_t p;
-			if (wordexp(token, &p, 0) == 0) {
-				argv[argc++] = p.we_wordv[0];
-				wordexp_results[wordexp_count++] = p; // Store for cleanup
+			if (wordexp(token, &p, 0) == 0 && p.we_wordc > 0) {
+				// Duplicate the string since we'll free the wordexp result
+				argv[argc] = strdup(p.we_wordv[0]);
+				wordfree(&p); // Free immediately after copying
+				if (argv[argc] != NULL) {
+					argc++;
+				}
 			} else {
 				argv[argc++] = token;
 			}
@@ -856,10 +858,9 @@ int32_t spawn(const Arg *arg) {
 		// 3. 执行命令
 		execvp(argv[0], argv);
 
-		// 4. execvp 失败时：清理并打印错误
-		for (int i = 0; i < wordexp_count; i++) {
-			wordfree(&wordexp_results[i]);
-		}
+		// 4. execvp 失败时：清理分配的字符串并打印错误
+		// Note: We only need to free strings that were strdup'd from wordexp
+		// The original tokens from arg->v don't need to be freed
 		wlr_log(WLR_ERROR, "mango: execvp '%s' failed: %s\n", argv[0],
 				strerror(errno));
 		_exit(EXIT_FAILURE); // 使用 _exit 避免缓冲区刷新等操作