fix(raw): check opcode byte counts without overflow

crates/raw/src/opcodes.rs

@@ -381,7 +381,7 @@ fn parse_gain_map(area: Area, reader: &mut Rd<'_>) -> Option<Opcode> {
     let origin = [reader.finite_f64()?, reader.finite_f64()?];
     let map_planes = reader.u32()?;
     let count = (points_v as usize).checked_mul(points_h as usize)?.checked_mul(map_planes as usize)?;
-    if count == 0 || count * 4 > reader.remaining() {
+    if count == 0 || count > reader.remaining() / 4 {
         return None;
     }
     let gains = (0..count).map(|_| reader.f32()).collect::<Option<_>>()?;
@@ -390,7 +390,7 @@ fn parse_gain_map(area: Area, reader: &mut Rd<'_>) -> Option<Opcode> {
 
 fn parse_delta_scale(id: u32, area: Area, reader: &mut Rd<'_>) -> Option<Opcode> {
     let count = reader.u32()? as usize;
-    if count * 4 > reader.remaining() {
+    if count > reader.remaining() / 4 {
         return None;
     }
     let values: Vec<f32> = (0..count).map(|_| reader.f32()).collect::<Option<_>>()?;

crates/raw/src/opcodes/tests.rs

@@ -1,5 +1,19 @@
 use super::*;
 
+#[test]
+fn reject_opcode_counts_whose_bytes_exceed_the_remaining_data() {
+    let mut gain_map = Vec::new();
+    for value in [u32::MAX, 1] {
+        gain_map.extend_from_slice(&value.to_be_bytes());
+    }
+    gain_map.extend(be(&[1.0, 1.0, 0.0, 0.0]));
+    gain_map.extend_from_slice(&1u32.to_be_bytes());
+    assert!(parse_gain_map(Area::default(), &mut Rd { d: &gain_map, p: 0 }).is_none());
+
+    let delta_count = u32::MAX.to_be_bytes();
+    assert!(parse_delta_scale(10, Area::default(), &mut Rd { d: &delta_count, p: 0 }).is_none());
+}
+
 pub(crate) struct ListWriter(pub Vec<u8>, pub u32);
 
 impl ListWriter {