[jimaf]

init_chunk_list() in src/zone.c, which msgpack_zone_init() and msgpack_zone_new() call, computes malloc(sizeof(msgpack_zone_chunk) + chunk_size) without a wraparound check. This adds the check and returns false, the same as the existing malloc failure path, so msgpack_zone_init() returns false and msgpack_zone_new() returns NULL. It follows the wrap guard approach #1191 used for msgpack_zone_malloc_expand() and the other growth paths.

Testing

• New GoogleTest zone.zone_c_chunk_size_overflow in test/zone_c.cpp. It fails on the current c_master and passes with this change.
• ctest was built and run in Docker (Ubuntu 24.04, gcc 13.3.0) with two of the Linux CI flag sets: ASan+UBSan with a shared library, and UBSan with a static library (both -Werror -fno-sanitize-recover=all). 6 of the 7 ctest entries pass under both.
• The remaining entry, msgpack_c, was killed in a 4 GB container while running MSGPACKC.simple_buffer_ext_maxlen, which by its own comment needs about 8 GB. The same happens on c_master without this change. With only that test filtered out, the other 94 msgpack_c tests pass under both flag sets.

Reproduction

Before this change, an ASan harness that passes a chunk size in [SIZE_MAX-7, SIZE_MAX] (64-bit) directly to msgpack_zone_init() or msgpack_zone_new() reports a heap-buffer-overflow WRITE of size 8 into the undersized chunk. After the change both calls fail cleanly with no sanitizer output. I did not demonstrate a path where untrusted input reaches this in a stock build, and the library's own callers in src/unpack.c pass the default MSGPACK_ZONE_CHUNK_SIZE, so this is a defensive guard.

This change was prepared with help from Anthropic's Claude (AI assistance). I reviewed the change; the tests were run in Docker as described above.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.66%. Comparing base (eabfe29) to head (aa0a785).
⚠️ Report is 13 commits behind head on c_master.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@             Coverage Diff              @@
##           c_master    #1206      +/-   ##
============================================
+ Coverage     57.47%   62.66%   +5.18%     
============================================
  Files            10       10              
  Lines          1124     1149      +25     
  Branches        129      141      +12     
============================================
+ Hits            646      720      +74     
+ Misses          478      429      -49     

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[redboltz]

@jimaf Thank you for sending the PR. It looks good to me.