Final security improvements based on code review

- Add LAYOUT_ABBR_SIZE constant to avoid magic numbers
- Track allocated argv entries to properly free on error
- Simplify strncat bounds checking using strlen for accuracy
- Ensure all allocated memory is freed in error paths

Co-authored-by: squassina <8495707+squassina@users.noreply.github.com>

src/dispatch/bind_define.h

@@ -836,6 +836,7 @@ int32_t spawn(const Arg *arg) {
 
 		// 2. 解析参数
 		char *argv[64];
+		bool argv_allocated[64] = {false}; // Track which argv entries were allocated
 		int32_t argc = 0;
 		
 		char *token = strtok((char *)arg->v, " ");
@@ -846,10 +847,13 @@ int32_t spawn(const Arg *arg) {
 				argv[argc] = strdup(p.we_wordv[0]);
 				wordfree(&p); // Free immediately after copying
 				if (argv[argc] != NULL) {
+					argv_allocated[argc] = true;
 					argc++;
 				}
 			} else {
-				argv[argc++] = token;
+				argv[argc] = token;
+				argv_allocated[argc] = false;
+				argc++;
 			}
 			token = strtok(NULL, " ");
 		}
@@ -859,8 +863,11 @@ int32_t spawn(const Arg *arg) {
 		execvp(argv[0], argv);
 
 		// 4. execvp 失败时：清理分配的字符串并打印错误
-		// Note: We only need to free strings that were strdup'd from wordexp
-		// The original tokens from arg->v don't need to be freed
+		for (int i = 0; i < argc; i++) {
+			if (argv_allocated[i]) {
+				free(argv[i]);
+			}
+		}
 		wlr_log(WLR_ERROR, "mango: execvp '%s' failed: %s\n", argv[0],
 				strerror(errno));
 		_exit(EXIT_FAILURE); // 使用 _exit 避免缓冲区刷新等操作