I have identified a potential integer overflow issue in the binary search implementation within the DSA size class lookup code.
Issue Description
In the current implementation, the calculation ofmidis performed as:
uint16 mid = (max + min) / 2;
Since bothmaxandminare of typeuint16, adding them together may exceed65535, leading to an overflow and incorrect behavior in the binary search logic. This could result in incorrect indexing into thedsa_size_classesarray.
The value of min is from the array dsa_size_class_map. The max value in dsa_size_class_map[] is 25.
The value of max is the length of dsa_size_classes[], which is not too large.
It will not happen that (max + min) exceeds 65535.
Proposed Fix
To prevent this overflow, we should use the alternative calculation method:
uint16 mid = min + (max - min) / 2;
This approach ensures that(max - min)does not exceed65535, preventing the addition from overflowing while still correctly computing the middle index.
