Summary

• Multiple places in the binary reader computed boundary offsets by adding a size value to the current position before checking bounds (e.g. read_end_ = state_.offset + section_size). On platforms where size_t is 32-bit, large size values cause the addition to wrap around, producing a small result that incorrectly passes subsequent bounds checks.
• Replace all addition-based checks with subtraction-based equivalents (size > end - offset), which are safe because the invariant state_.offset <= read_end_ is always maintained.
• Add regression tests with oversized section and subsection sizes.

Details

The vulnerable pattern appears in 6 locations:

On 32-bit platforms where Offset is size_t (= uint32_t), a section_size of e.g. 0xFFFFFFF0 added to an offset of 0x20 produces 0x10, which passes the check read_end_ <= state_.size even though the section extends far past the buffer.

Fix: Use subtraction from the known-good bound instead:

// Before (overflow-prone):
ERROR_UNLESS(state_.offset + size <= read_end_, ...);
// After (overflow-safe):
ERROR_UNLESS(size <= read_end_ - state_.offset, ...);

For ReadSections, add an explicit overflow check before computing read_end_.

Test plan

• New test BinaryReader.OversizedSectionSize with a 2 GiB section size in a tiny module
• New test BinaryReader.OversizedSubsectionSize with a name section subsection exceeding the section boundary
• All existing unit tests pass (129 tests)