Detect integer overflow in Array.concat

[yallop]

This pull request is part of an occasional series on bounds checking and integer overflow. (Previous installments: #250, #805.)

Description

The code used to calculate the size of the output array in Array.concat doesn't detect integer overflow. Consequently, passing a single (moderately-sized) list with multiple references to a large array can lead to out-of-bounds writes.

Demonstration

Here's a program that demonstrates the problem on a 32-bit platform.

open Int32

let big = Array.make Sys.max_array_length ()

let push x l = l := x :: !l
let (+=) a b = a := add !a b

let sz, l = ref zero, ref []

let () = begin
  while !sz >= zero do push big l; sz += of_int Sys.max_array_length done;
  while !sz <= zero do push big l; sz += of_int Sys.max_array_length done;
end

let _ = Array.concat !l

And here's the result of compiling and running the program:

$ ocamlopt ~/arrayconcat.ml
$ ./a.out
Segmentation fault (core dumped)

Here's what happens with the addition of this patch:

$ ocamlopt ~/arrayconcat.ml
$ ./a.out 
Fatal error: exception Invalid_argument("Array.concat")

[damiendoligez]

Reviewed, merged, and cherry-picked to 4.04 (commit 0b76fa9).