#370 Integer overflow in function has_data and get_data

[xiaoxiaoafeifei]

Summary
Signed integer overflow in DataPool::has_data() causes SIGILL DoS on djvulibre git master

Version
git master 69e23da (2026-06-30). All releases ≤ 3.5.30 affected.

Root cause
libdjvu/DataPool.cpp:1093 evaluates start + dstart + dlength <= length with all int operands. Crafted input with dstart = INT_MAX overflows, triggering UB → SIGILL

Reproduction
./configure CFLAGS="-g -O0 -fsanitize=address,undefined" CXXFLAGS="-g -O0 -fsanitize=address,undefined" && make && make install
./ddjvu ./ddjvu_poc0 /dev/null
→
DataPool.cpp:1093:48: runtime error: signed integer overflow: 2147483647 + 8226 cannot be represented in type 'int'
DataPool.cpp:1173:30: runtime error: signed integer overflow: 2147483647 + 512 cannot be represented in type 'int'

Evidence
UBSan: signed integer overflow: 2147483647 + 8226 @ DataPool.cpp:1093
GDB: SIGILL @ DataPool.cpp:1093
Impact
Local DoS via crafted .djvu

[xiaoxiaoafeifei]

修复补丁见附件