[jimaf]

The zone chunk_list constructor, reached from msgpack::zone(size_t chunk_size), computes ::malloc(sizeof(chunk) + chunk_size) without a wraparound check. This adds the check and throws std::bad_alloc, the same as the existing malloc failure path, in cpp11_zone.hpp, cpp03_zone.hpp and erb/v1/cpp03_zone.hpp.erb. It uses the std::numeric_limits<size_t>::max() - x form that #1192 used for allocate_align(). cpp03_zone.hpp regenerated from the erb with ./preprocess is identical to the edited file.

Testing

• New Boost.Test case constructor_chunk_size_overflow in test/zone.cpp. It fails on the current cpp_master and passes with this change.
• ctest was built and run in Docker (Ubuntu 24.04, g++ 13.3.0, Boost 1.83) with the CI style flags -Werror -g -fsanitize=undefined -fno-sanitize-recover=all: C++11 passes 39/39 and C++17 passes 40/40.
• For both, -Wno-self-move was added. Without it, GCC 13 stops the build with -Werror=self-move on the intentional self-move in test/security_fixes_cpp11.cpp. That happens on cpp_master without this change and is unrelated to it.

Reproduction

Before this change, an ASan harness that constructs msgpack::zone with a chunk size in [SIZE_MAX-7, SIZE_MAX] (64-bit), built both as C++11 and as C++03, reports a heap-buffer-overflow WRITE of size 8 into the undersized chunk. After the change the constructor throws std::bad_alloc and there is no sanitizer output. I did not demonstrate a path where untrusted input reaches this in a stock build, so this is a defensive guard.

This change was prepared with help from Anthropic's Claude (AI assistance). I reviewed the change; the tests were run in Docker as described above.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.85%. Comparing base (39cc081) to head (ec53a2a).
⚠️ Report is 34 commits behind head on cpp_master.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@              Coverage Diff               @@
##           cpp_master    #1207      +/-   ##
==============================================
- Coverage       85.36%   79.85%   -5.52%     
==============================================
  Files              80       80              
  Lines            5099     5799     +700     
  Branches          507      637     +130     
==============================================
+ Hits             4353     4631     +278     
- Misses            746     1168     +422     

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[redboltz]

@jimaf thank you for sending the PR. It looks good to me.