[nidu-ninja]

PR adds overflow checks to several memory allocations in
ZDICT_trainBuffer_legacy() within zdict.c.

The function previously computed allocation sizes using expressions such as:

(bufferSize + N) * sizeof(type)
nbFiles * sizeof(type)

without validating whether the intermediate arithmetic could overflow size_t.

[itsgaldoron]

Hi @nidu-ninja — taking this one over per the dormant-PR convention (no activity since it was opened on 2026-03-09), disclosed in my PR #4889.

The wrap is still reachable at dev (49cf517): on 32-bit targets, (bufferSize+2)*sizeof(*suffix0) and bufferSize*sizeof(*reverseSuffix) wrap for bufferSize >= 0x3FFFFFFE (~1 GB of samples, accepted through the public ZDICT_trainFromBuffer_legacy() entry), the suffix arrays under-allocate (8 and 0 bytes), and divsufsort() writes out of bounds — measured as an ASan heap-buffer-overflow WRITE of size 4 in sort_typeBstar() (divsufsort.c:1469) and a SIGSEGV through the public entry on i386.

#4889 guards the same four products with the same rejection semantics and adds the regression test this PR doesn't ship (tests/fuzzer.c: a legacy-entry control cell plus a fork()-isolated wrapping-size cell gated to 32-bit — it fails on an unfixed tree and passes after the fix). If you plan to continue here I'll gladly drop #4889 and rebase my test onto your patch instead.