SIGN IN SIGN UP

Fix the 32-bit overflow in the PawnIOUtil blob parser

sigsize + 4 + 6 was computed in 32 bits and wrapped, while
input.begin() + 4 + sigsize promotes to 64 bits and does not. A nine-byte
file of FF FF FF FF 00 00 00 E1 F1 therefore satisfied every guard and then
built a vector spanning roughly 4 GB from a nine-byte heap block. Reachable
from sign, test and interactive.

Widening sigsize to size_t makes the bounds check the 64-bit computation the
indexing already was. The driver copy of the same parse was already correct.
N
namazso committed
b0c8134de473ab3be599b9a2aa16fa16383355cd
Parent: 35a01b0