Fix traversal buffer size overflow

src/fstapi.c

@@ -5118,8 +5118,18 @@ int fstReaderIterBlocks2(fstReaderContext *ctx,
             }
         }
 
-        mem_required_for_traversal =
-            fstReaderUint64(xc->f) + 66; /* add in potential fastlz overhead */
+        {
+            uint64_t declared_traversal_len = fstReaderUint64(xc->f);
+
+            /* check for overflow */
+            if (declared_traversal_len >= (UINT64_MAX - 66)) {
+                goto block_err;
+            }
+
+            /* add in potential fastlz overhead */
+            mem_required_for_traversal = declared_traversal_len + 66;
+        }
+
         /* extra null byte to catch any unterminated varint */
         mem_for_traversal = (unsigned char *)calloc(1, mem_required_for_traversal + 1);
 #ifdef FST_DEBUG

tests/meson.build

@@ -37,6 +37,7 @@ malformed_cases = [
     'time_chain_short',
     'traversal_buffer_smaller_than_chain',
     'traversal_buffer_smaller_than_chain_fastlz',
+    'traversal_size_wraps',
     'uncompressed_chain_past_traversal',
     'uncompressed_chain_shorter_than_its_varint',
     'value_change_past_traversal',

tests/reader_malformed_files.c

@@ -89,6 +89,10 @@
  *       nothing compared against the buffer.  One file per decompressor: LZ4
  *       writes eight bytes at a time past the end, fastlz one
  *
+ *   traversal_size_wraps.fst
+ *       the second of two value change sections declares a traversal size of
+ *       2**64 - 67
+ *
  *   uncompressed_chain_past_traversal.fst
  *       a value change section declaring it needs 7 bytes of memory to read,
  *       whose twenty handles share one uncompressed chain 19 bytes long and so