[nidu-ninja]

This PR hardens COVER_map_init() in cover.c by adding validation for
bit shifts and allocation size computations.

The original implementation computed map size using a left shift and
performed a multiplication before malloc without validating whether
these operations could overflow.

[itsgaldoron]

This PR has been inactive since 2026-03-18. I have picked the fix up in #4887 — same root cause re-derived on current dev (reject unrepresentable COVER_map_init capacities: the sizeLog >= 32 shift UB, the size == 0 edge, and the 32-bit pair-array allocation wrap), plus the matching bound in COVER_checkParameters(), a regression test in tests/fuzzer.c, and two-state evidence (unpatched: SIGSEGV / UBSan shift-exponent abort / i386 heap-corruption abort; patched: clean parameter_out_of_bound). Happy to drop #4887 if you plan to continue here.