The portable fallback used when __builtin_umulll_overflow is not
available computed a > UINT64_MAX / b, which divides by zero if b is 0.
No current caller passes 0, but return no overflow in that case so the
helper is safe for any input.

The binary plist parser validated object data by computing pointers such
as `object + size` or `refs + j * ref_size` and comparing them against the
offset table. Each of these checks had to be written with its own
wrap-around handling, and the pointer was formed before it was known to
be inside the input buffer.

Add bplist_object_range_valid(), which checks a length against the bytes
remaining before the offset table, and bplist_read_object_ref(), which
reads an array/dict object reference with an overflow-checked offset.
Use them for all object data checks in parse_bin_node() and for the
reference reads in parse_array_node() and parse_dict_node(). Arrays and
dicts now validate the full reference list (count * ref_size, or twice
that for dicts) up front instead of only the item count.

The node offset checks in parse_bin_node_at_index() and the offset table
check in plist_from_bin() compare offsets instead of pointers as well.

Valid binary plists are parsed exactly as before.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Found by failing each allocation in turn under ASan/UBSan/LSan:

- plist_free() leaked the whole tree if its work stack could not be
  allocated; free the children iteratively without extra memory
- plist_copy(): when a shallow copy of a dict/array failed, the original's
  lookup table was freed along with the copy's data (use-after-free)
- bplist parser: fix a NULL dereference in parse_date_node(), check the
  node_attach() results, and don't leak on failure; plist_to_bin() no
  longer leaks on an allocation failure
- free the plist data when node creation fails (plist constructors, XML,
  JSON and binary parsers)

- check malloc/calloc/realloc results in constructors, the JSON and
  OpenStep writers, the XML text-part helpers and base64 decoding, and
  return PLIST_ERR_NO_MEM instead of asserting or dereferencing NULL
- guard size calculations against overflow in the UTF-8/UTF-16BE
  conversions, ptrarray, and bytearray
- make hash_table_insert() report failure instead of silently dropping
  the entry; writers propagate PLIST_ERR_NO_MEM, and dict lookup caches
  are discarded so lookups fall back to a linear search
- don't overwrite an earlier parse error code in the XML parser, and
  report PLIST_ERR_NO_MEM when reading text content fails for lack of memory
- OpenStep parser: check node/data/string allocations and dict/array
  insertion results

Based on #323 by bg0d-droid.

Co-authored-by: bg0d-droid <81825610+bg0d-droid@users.noreply.github.com>

Binary plist objects may be referenced multiple times, and each
reference is parsed into a separate node. A tiny crafted input where
arrays reference the same objects repeatedly (without forming a cycle,
so the recursion check does not trigger) expands into millions of
nodes and exhausts memory.

Track the number of nodes parsed and fail with PLIST_ERR_PARSE once it
exceeds num_objects * 16 + 65536. Legitimate files create roughly as
many nodes as they have objects, so they stay well below this limit.

Credit to OSSFuzz

byte_array_grow() assigned the result of realloc() directly to
ba->data and increased the capacity even if realloc() failed, so the
following memcpy() in byte_array_append() wrote to NULL + len.

On failure, free the old buffer and leave the byte array in a failed
state (data == NULL), which byte_array_append() already ignores. The
callers check for that state:

- the writers (bin, xml, json, openstep and the text output formats)
  return PLIST_ERR_NO_MEM instead of handing out a NULL/truncated buffer
- node_to_xml() base64-encodes <data> directly into the grown buffer,
  so it must bail out there (only guarded by assert() before)
- the OpenStep parser returns PLIST_ERR_NO_MEM for <hex data> instead of
  silently returning truncated data

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ptr_array_insert() assigned the result of realloc() directly to
pa->pdata and bumped the capacity without checking for failure, so on
out-of-memory the old buffer was leaked and the following store or
memmove() wrote through a NULL pointer.

Keep the old buffer on failure and return -1 from ptr_array_insert()
and ptr_array_add(). The callers now handle the error:

- the array lookup cache (plist.c) is dropped instead of silently going
  out of sync with the node list; lookups then fall back to walking
  the children, as they do before the cache exists
- bplist parsing (used_indexes) and serialization (objects) return
  PLIST_ERR_NO_MEM; ignoring the error in parse_bin_node_at_index()
  would otherwise loop forever since the array never grows

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Credit to OSSFuzz