Couple of hardening changes for utils flagged by kres (#42732)

src/basic/string-util.c

@@ -287,6 +287,12 @@ static size_t previous_ansi_sequence(const char *s, size_t length, const char **
 
         /* Locate the previous ANSI sequence and save its start in *ret_where and return length. */
 
+        if (length < 2) {
+                /* Need at least two bytes for an ANSI sequence */
+                *ret_where = NULL;
+                return 0;
+        }
+
         for (size_t i = length - 2; i > 0; i--) {  /* -2 because at least two bytes are needed */
                 size_t slen = ansi_sequence_length(s + (i - 1), length - (i - 1));
                 if (slen == 0)

src/basic/uid-range.c

@@ -395,9 +395,18 @@ int uid_range_partition(UIDRange *range, uid_t size) {
         if (n_new_entries > range->n_entries && !GREEDY_REALLOC(range->entries, n_new_entries))
                 return -ENOMEM;
 
-        /* Work backwards to avoid overwriting entries we still need to read */
+        /* Compact in place: drop entries that contribute zero partitions (nr < size). This forward pass
+         * reads each entry once and only writes to lower-or-equal indices, so it cannot alias an unread
+         * source entry. */
+        size_t n_src = 0;
+        for (size_t i = 0; i < range->n_entries; i++)
+                if (range->entries[i].nr >= size)
+                        range->entries[n_src++] = range->entries[i];
+
+        /* Pre-compaction guarantees every surviving entry contributes at least one partition slot, so the
+         * write cursor t stays ahead of the read index. */
         size_t t = n_new_entries;
-        for (size_t i = range->n_entries; i > 0; i--) {
+        for (size_t i = n_src; i > 0; i--) {
                 UIDRangeEntry *e = range->entries + i - 1;
                 unsigned n_parts = e->nr / size;