[PATCH 2/5] http: use `size_t` for byte position in fwrite_sha1_file

From: Johannes Schindelin <johannes.schindelin@gmx.de>

The `fwrite_sha1_file()` function tracks the number of bytes written via an `int` variable, but the total size to write is of type `size_t`. When the HTTP response body exceeds INT_MAX (~2GB), this causes an overflow and a heap under-read, then writes that data to the local object file.

The hash check afterward would reject the corrupt object (so no bad data enters the object store), but the under-read itself could leak adjacent heap contents to the temporary file. In practice this is unlikely because curl delivers data in small chunks (typically 16KB per callback invocation), so in practice, the total size is far below INT_MAX in a single call. However, the function interface accepts arbitrary sizes, and the accumulation across the loop means that the `int` variable grows across calls within a single invocation, not across callbacks.

Change the type from `int` to `size_t` to match the type of the total size. This is a hardening fix: the attack surface (a malicious HTTP server triggering a >2GB single-callback delivery) is theoretical under normal curl configurations, but the type mismatch is a genuine defect.

Pointed out by Coverity.

Assisted-by: Claude Opus 4.6
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
---
 http.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)