file_sys: reject NUP tables with wrapping bounds or cyclic directories

31b901b93b checked the TOC with unchecked arithmetic on counts and
offsets read from the file. The record-table size (u64 count times
record size) and u32 first_child + child_count can wrap, so the bounds
checks pass and later reads go out of bounds; the same holds for the
TOC range, name ranges, file extents and the meta range. A directory
that lists its own ancestor as a child also made BuildDirTree recurse
until the stack overflowed.

Bound the counts by the TOC size before multiplying, compare ranges by
subtraction, and widen the child range to u64. Walk the directory graph
once after parsing with an explicit stack and reject cycles and nesting
deeper than 128, so BuildDirTree can no longer recurse without bound.
The file is rejected with ErrorNUPBadFormat.

Assisted-by: Claude Sonnet 5.5 (implementation and commit message)

0 files changed, 0 insertions, 0 deletions