[sundaysebasidian-byte]

Related to #217.

Changes

Add private C99 checked size_t add/multiply helpers and use them for allocation sizes, scanline/image sizes, and buffer growth. They return overflow without modifying the result and handle zero operands and aliased inputs. Public headers and ABI are unchanged; existing error codes and the progressive image-size overflow sentinel are preserved.

This also replaces the ineffective encoded-buffer doubling guard and avoids division by zero in the zero-item allocation check. This is focused preventive hardening, not a claim of a discovered exploit or an exhaustive arithmetic audit. Remaining bounded serialization/counter calculations are outside this change.

Add a development-only regression executable covering zero/exact-limit/overflow cases, allocator rejection without giant allocations, growth/cache boundaries, image-size failures and progressive behavior. Normal-image coverage includes all 15 legal PNG color/depth combinations, six image sizes, both interlace modes and ordinary/progressive encoding and decoding (360 encodes, 720 decodes), including actual output-buffer growth.

Validation

On macOS ARM64 with Apple Clang 21, using the repository-pinned libpng 1.6.37 and miniz 2.2.0:

• Pristine baseline: 167 passed, 41 expected failures, no unexpected failures.
• Five complete patched suites: debug, zlib ASan/UBSan, static release without SIMD, miniz debug, and miniz ASan/UBSan with the dependency instrumented. Each: 168 passed, the same 41 expected failures, no unexpected failures; no sanitizer diagnostics in full logs.
• Strict C99 -Wall -Wextra -Werror -pedantic checks on ARM64 and x86_64; x86_64 tests executed under Rosetta. i386 production/test compilation passed.
• CMake shared/static/example build; before/after Clang Static Analyzer comparison. The same two baseline warnings (packed-sample shift-path analysis and an overwritten gray8 initializer) were separately examined and are not suppressed.
• Differential checks against the original implementation and arbitrary-precision arithmetic for helper, scanline, image-size and growth calculations. Separate adversarial review also checked 15,000,225 helper input pairs against a 128-bit oracle.

The host's newer libpng 1.6.58 caused two pre-existing baseline metadata failures; the full-suite counts above use the project's pinned version. Actual 32-bit execution, Windows/MSVC, Linux/GCC, MemorySanitizer and a live OSS-Fuzz corpus campaign were not run. No performance benchmark was performed.

AI disclosure

Implementation, regression tests and review were produced with OpenAI Codex AI assistance, including separate AI review agents. The review was not performed by an independent human. The submitted files are exactly the locally tested and reviewed snapshot.