bufq: add integer overflow checks before chunk allocations

[coleleavitt]

Add defensive int overflow checking in the buffer queue allocation functions to prevent potential heap buffer overflows if large chunk sizes are ever used.

The calculation sizeof(*chunk) + q->chunk_size has the potential to overflow if chunk_size is near SIZE_MAX which results in a smaller allocation than intended.

Through testing this is not an exploitable vulnerability in release.

[bagder]

SIZE_MAX is a very large limit but I suppose the check is still sensible!

[bagder]

This will be easier if you stop merging in unrelated things.

[bagder]

Thanks!