Cdb_get_str with invalid parameter value

If i pass size as -1 or 0, still this API is successfull ?
If cdb_api dont have any kind of validations? or its left to the applications?

See why the common type is compared (unsigned int) and how therefore -1 will be converted to UINT_MAX for example here:

BTW, you have the libconfd source code to refer to for questions like these.