[PATCH v9] diff-delta: use safe integer arithmetic

From: Srujith A Poojary <poojarysrujith@gmail.com>

In create_delta_index(), buffer sizes for allocating the delta index are calculated using arithmetic operations on entries and hsize:

  memsize = sizeof(*hash) * hsize + sizeof(*entry) * entries

To prevent potential size_t wrap-around when computing allocation sizes on 32-bit systems, replace manual arithmetic with overflow-checked helpers (st_mult, st_add, st_add3).

Struct sizes and alignment rules (such as padding for struct unpacked_index_entry) are implementation-defined and can vary across compilers and platforms. While current bounds on entries and hsize limit allocation sizes (with entries capped by 0xfffffffeU / RABIN_WINDOW and hsize capped at 2^26 with a minimum of 16), using st_mult() and st_add() provides robust defensive programming—ensuring that any future layout changes, compiler padding differences, or boundary adjustments will safely die() on size_t overflow instead of wrapping around.

For the packed index allocation:
- (hsize + 1) is passed to st_mult(), which is evaluated as an argument
  inside st_add3(), and is safe from overflow because hsize is capped early
  in the function.

Signed-off-by: Srujith A Poojary <poojarysrujith@gmail.com>
---
    [Outreachy PATCH] diff-delta: use safe integer arithmetic

Published-As: https://github.com/gitgitgadget/git/releases/tag/pr-2276%2Fpoojarysrujith%2Fc-refactor-target-name-v9
Fetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-2276/poojarysrujith/c-refactor-target-name-v9
Pull-Request: https://github.com/gitgitgadget/git/pull/2276

Range-diff vs v8:

 1:  0b88f5a10b ! 1:  1be2ccdf19 diff-delta: use safe integer arithmetic
     @@ Commit message
          on 32-bit systems, replace manual arithmetic with overflow-checked
          helpers (st_mult, st_add, st_add3).
      
     -    For the unpacked index allocation:
     -    - sizeof(struct unpacked_index_entry) is 16 bytes on 32-bit systems
     -      (4 bytes for ptr, 4 bytes for val, and 4 bytes for the next pointer,
     -      where "inner entry" consists of ptr + val).
     -    - sizeof(struct index_entry *) is 4 bytes.
     -    - entries is capped by 0xfffffffeU / RABIN_WINDOW, limiting entries.
     -    - hsize is the smallest power of 2 >= (entries / 4), capped at 2^26
     -      (with a minimum of 16).
     -
     -    Using st_mult() and st_add() guarantees that any allocation calculations
     -    will safely die() on size_t overflow instead of wrapping around.
     +    Struct sizes and alignment rules (such as padding for
     +    struct unpacked_index_entry) are implementation-defined and can vary
     +    across compilers and platforms. While current bounds on entries and
     +    hsize limit allocation sizes (with entries capped by 0xfffffffeU /
     +    RABIN_WINDOW and hsize capped at 2^26 with a minimum of 16), using
     +    st_mult() and st_add() provides robust defensive programming—ensuring
     +    that any future layout changes, compiler padding differences, or boundary
     +    adjustments will safely die() on size_t overflow instead of wrapping around.
      
          For the packed index allocation:
          - (hsize + 1) is passed to st_mult(), which is evaluated as an argument

 diff-delta.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)