Fix integer overflow-prone offset+len bounds checks in NVM read handlers

[jackctj117]

This pull request addresses integer overflow vulnerabilities in range and bounds checks throughout the NVM read and partition logic, replacing potentially unsafe arithmetic with overflow-safe comparisons. It also adds new regression tests to ensure these checks are robust and behave as expected.

Overflow-safe bounds checking improvements:

• Updated nfPartition_CheckDataRange, nfObject_ReadDataBytes, and logic in wh_server_nvm.c to use overflow-safe comparisons (e.g., if (byte_count > maxOffset - byte_offset)) instead of potentially unsafe arithmetic like if (byte_offset + byte_count > maxOffset). This prevents integer overflows that could allow out-of-bounds access. [1] [2] [3] [4]

Testing and validation:

• Added new regression tests in _testOutOfBoundsNvmReads to verify that large offsets and lengths are correctly rejected or clamped, ensuring the overflow-safe logic works as intended and preventing future regressions.

[Copilot]

Pull request overview

This PR hardens NVM read/partition bounds checking against integer-overflow edge cases by replacing offset + len style comparisons with subtraction-based, overflow-safe checks, and adds regression coverage for out-of-bounds reads.

Changes:

• Updated NVM read handlers to clamp len using overflow-safe comparisons (len > meta.len - offset).
• Updated NVM flash partition/object range validation to avoid overflow in bounds checks.
• Extended client/server regression tests for out-of-bounds NVM reads and clamping behavior.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
src/wh_server_nvm.c	Uses overflow-safe len > meta.len - offset clamping in NVM read paths (incl. DMA).
src/wh_nvm_flash.c	Reworks partition/object range checks to avoid byte_offset + byte_count overflow.
test/wh_test_clientserver.c	Adds regression assertions for rejection/clamping behavior around NVM reads.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[bigbrett]

This new test doesn't actually test your fix FYI but there isn't a good way to test it.

The first test is caught by the pre-existing offset >= meta.len guard before reaching the changed line. This one exercises the clamping logic but with values too small to trigger any overflow