Config parser reads beyond the end of given config buffer.

1. In the __config_process_value, if the config item type is WT_CONFIG_ITEM_NUM, then the value is parsed by calling strtoll.
2. The strtoll call expects null-terminated string and won's stop reading until it encounters 0 or non-numeric character.

For example, the following code will trigger the bug:

const char *s = "val=1";
uint8_t cfg[5];
memcpy(cfg, s, strlen(s));
...
WT_CONFIG conf;
WT_CONFIG_ITEM key, value;
__wt_config_initn(session, &conf, cfg, sizeof(cfg));
__wt_config_next(&conf, &key, &value);

Solution:
Parse config string only up to the length limit as specified in the given WT_CONFIG_ITEM.