CPS: Fix crashes on invalid versions

The current parsing doesn't handle special cases very well, such as
spaces (entirely space, or leading whitespace) and overflows.

Source/cmPackageInfoReader.cxx

@@ -15,6 +15,7 @@
 #include <cm3p/json/version.h>
 
 #include "cmsys/RegularExpression.hxx"
+#include "cmsys/String.h"
 
 #include "cmCxxModuleMetadata.h"
 #include "cmExecutionStatus.h"
@@ -437,11 +438,10 @@ cm::optional<cmPackageInfoReader::Pep440Version> ParseSimpleVersion(
     }
 
     // Extract the part as a number.
-    cm::string_view const part = remnant.substr(0, n);
-    std::string::size_type const l = part.size();
-    std::string::size_type p;
-    unsigned long const value = std::stoul(std::string{ part }, &p);
-    if (p != l || value > std::numeric_limits<unsigned>::max()) {
+    unsigned long value;
+    std::string const part = std::string{ remnant.substr(0, n) };
+    if (!cmsysString_isdigit(part[0]) || !cmStrToULong(part, &value) ||
+        value > std::numeric_limits<unsigned>::max()) {
       // The part was not a valid number or is too big.
       return cm::nullopt;
     }

Tests/RunCMake/find_package-CPS/InvalidVersion.cmake

@@ -0,0 +1,14 @@
+cmake_minimum_required(VERSION 4.0)
+
+include(Setup.cmake)
+
+set(CMAKE_FIND_PACKAGE_SORT_ORDER NAME)
+set(CMAKE_FIND_PACKAGE_SORT_DIRECTION ASC)
+
+###############################################################################
+# Test that malformed versions are rejected (rather than crashing).
+find_package(InvalidVersion 1.0 QUIET)
+if(InvalidVersion_FOUND)
+  message(SEND_ERROR "InvalidVersion unexpectedly found with version "
+                     "\"${InvalidVersion_VERSION}\" !")
+endif()

Tests/RunCMake/find_package-CPS/RunCMakeTest.cmake

@@ -37,6 +37,7 @@ run_cmake(VersionLimit1)
 run_cmake(VersionLimit2)
 run_cmake(TransitiveVersion)
 run_cmake(CustomVersion)
+run_cmake(InvalidVersion)
 
 # Metadata Tests
 run_cmake(License)

Tests/RunCMake/find_package-CPS/cps/InvalidVersion/1/InvalidVersion.cps

@@ -0,0 +1,7 @@
+{
+  "cps_version": "0.13",
+  "name": "InvalidVersion",
+  "version": " ",
+  "cps_path": "@prefix@/cps/InvalidVersion/1",
+  "components": {}
+}

Tests/RunCMake/find_package-CPS/cps/InvalidVersion/2/InvalidVersion.cps

@@ -0,0 +1,7 @@
+{
+  "cps_version": "0.13",
+  "name": "InvalidVersion",
+  "version": " 1",
+  "cps_path": "@prefix@/cps/InvalidVersion/2",
+  "components": {}
+}

Tests/RunCMake/find_package-CPS/cps/InvalidVersion/3/InvalidVersion.cps

@@ -0,0 +1,7 @@
+{
+  "cps_version": "0.13",
+  "name": "InvalidVersion",
+  "version": "1 ",
+  "cps_path": "@prefix@/cps/InvalidVersion/3",
+  "components": {}
+}

Tests/RunCMake/find_package-CPS/cps/InvalidVersion/4/InvalidVersion.cps

@@ -0,0 +1,7 @@
+{
+  "cps_version": "0.13",
+  "name": "InvalidVersion",
+  "version": "99999999999999999999",
+  "cps_path": "@prefix@/cps/InvalidVersion/4",
+  "components": {}
+}