reftable_alloc_size() takes its arguments as size_t, but
reftable_obj_record_decode() passes it a uint64_t count. On 32-bit
platforms, a count wider than 32 bits is truncated before the overflow
check, so the decoder can get a small allocation for a large count and
write past its end. reftable_calloc() takes size_t arguments the same
way.
Make reftable_alloc_size() and reftable_calloc() take uintmax_t
arguments, so the check sees the full count.
Assisted-by: Claude Opus 5.5
Helped-by: Patrick Steinhardt <ps@pks.im>
Helped-by: Aniket Gupta <aniketgupta3001@gmail.com>
Signed-off-by: Matthew Suozzo <m@suozzo.co>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Matthew Suozzo
2d19e6bfa9