BUG: Refuse a header whose dimensions overflow the voxel count

[gdevenyi]

Both header converters multiply the dimensions into nim->nvox without
checking the product:

for( ii=1, nim->nvox=1; ii <= nhdr.dim[0]; ii++ )
   nim->nvox *= nhdr.dim[ii];

Seven NIFTI-1 dimensions of 32767 are enough to overflow int64_t, and a
NIFTI-2 header needs only two dimensions to do it:

nifti2_io.c:4838: runtime error: signed integer overflow:
    1152780773560811521 * 32767 cannot be represented in type 'int64_t'

Signed overflow is undefined, and what the compiler does produce is a
voxel count that no longer describes the file. nvox then goes on to
nifti_get_volsize(), which multiplies it by nbyper for another
unchecked product, and that result is used as an allocation size and a
read length.

Both products are now checked before they are made, in the way the
surrounding code already reports a bad header. A header that overflows
is rejected with a message instead of producing a silently wrong image.
No valid image is affected: an int64_t voxel count is more than any
file can hold.

Found by fuzzing the header converters with clang's libFuzzer under
UndefinedBehaviorSanitizer.

---

How to reproduce, and the sanitizer builds used, are in the commit message. Found with clang libFuzzer harnesses over nifti_image_read(), the two header converters, nifti_image_from_ascii() and axml_read_buf(), run under AddressSanitizer, UndefinedBehaviorSanitizer and MemorySanitizer.

One commit on master, independent of my other open PRs. ctest passes on master with this branch alone (343/343, excluding the nifti_c22_copy_image failure that #31 fixes), and on the union of all my branches under ASan+UBSan, TSan and MSan.

[gdevenyi]

Pushed a second commit. The first one guards both converters in nifti2/nifti2_io.c, but niftilib/nifti1_io.c has the same loop in nifti_convert_nhdr2nim(), on the same untrusted path, and was left unguarded:

$ nifti1_tool -disp_nim -infiles huge.nii     # dim[0]=7, dim[1..7]=32767
  dim     32  8  7 32767 32767 32767 32767 32767 32767 32767
  nvox    64  1  -1073512449

The wrapped count then becomes the data allocation size and the result of nifti_get_volsize(). With the guard the header is refused instead.

nifti_image.nvox is a size_t in this library and an int64_t in the NIFTI-2 one, so the bound here is SIZE_MAX, not INT64_MAX; nifti_get_volsize() is size_t * size_t to match.

Two more nvox loops remain in each library — nifti_update_dims_from_array() and update_nifti_image_for_brick_list(). Both take dims a caller has already set rather than dims read from a file, and are reached from nifti_tool's command line, so I left them for a separate change rather than widen this one.

[hjmjohnson]

The commit messages in this range were rewritten to remove trailers that do not belong in permanent history: Co-Authored-By: naming an AI tool, and Claude-Session: URLs that resolve for nobody. Only messages changed — the tree at the tip of master is byte-identical, and author, committer, and dates are preserved.

This PR's commits on the rewritten master:

• 66c76c22ea BUG: Refuse a header whose dimensions overflow the voxel count
• 147a07a48f BUG: Guard the voxel count in the NIFTI-1 library too

The SHA recorded above by GitHub is from the pre-rewrite history and no longer resolves.