Harden image loader buffer size arithmetic #339

Summary

Some image loaders compute decoded frame buffer sizes from dimensions that come from untrusted image files. These calculations should consistently use checked 64-bit arithmetic before allocation, copying, or passing output buffers to decoder APIs.

This issue tracks hardening those paths so oversized or malformed dimensions are rejected before any size calculation can wrap.

Scope

The affected hardening targets are:

• AVIF decoded frame allocation
• HEIF image size and stride validation
• JXL frame allocation and decoder output buffer sizing
• WebP frame buffer copies
• File mapping robustness when fstat() fails or reports an invalid size

Validation Plan

• Add a regression test for checked image buffer arithmetic.
• Build with sanitizers and verify the arithmetic regression test passes.
• Run the existing C unit tests.
• Run the full existing test suite in a clean normal build.

Disclosure Note

This issue intentionally avoids exploit-style details or weaponized samples. The linked PR contains the defensive changes and validation summary.