From: Matthew Suozzo <m@suozzo.co>

An object record's count of offsets is a 64-bit varint from the table,
and reftable_obj_record_decode() allocates the offsets array from it
through REFTABLE_ALLOC_ARRAY(), which takes a size_t. Where size_t is
32 bits, a count of 2^32 + 1 allocates room for one offset, and the
loop, which runs to the full count, writes an offset from the table
for each varint left in the block past the end of the array. Where
size_t is 64 bits, a large count only makes a large allocation that
the decode then fails to fill.

Nothing in Git reaches this decoder from a repository: a block of a
type other than the one wanted is refused before its records are
decoded, and the object index, the only reader of object blocks, is
used only by the unit tests. The decoder is still wrong.

Each offset takes at least a byte, so refuse a count larger than what
is left of the record.

The Makefile did not build the reftable record unit tests (the Meson
build does). Add the suite there so that the new test runs in both.

Assisted-by: Claude Opus 5.5, Claude Fable 5.1
Signed-off-by: Matthew Suozzo <m@suozzo.co>

Submitted-As: https://lore.kernel.org/git/pull.2255.git.1791989883899.gitgitgadget@gmail.com