[jcelerier]

Fixes #87.

ogt_vox_read_scene() validates size_x/size_y/size_z only for non-zero, so a crafted SIZE chunk reaches:

uint32_t voxel_count = size_x * size_y * size_z;
_vox_calloc(sizeof(ogt_vox_model) + voxel_count);

with dimensions whose product wraps. 65536 x 65536 x 1 overflows uint32 to 0, the allocation collapses to sizeof(ogt_vox_model), and the XYZI loop — whose only bound is x < size_x && y < size_y && z < size_z, all of which hold — writes the voxel payload far past it.

AddressSanitizer:

ERROR: AddressSanitizer: heap-buffer-overflow
WRITE of size 1, 0 bytes after a 24-byte region
    ogt_vox.h:1590 in ogt_vox_read_scene_with_flags

Under NDEBUG the surrounding ogt_asserts are compiled out, so this is reachable in release builds from a file alone.

Why each axis is bounded before the product

Widening the multiply is not sufficient on its own. Three uint32 dimensions need up to 96 bits, so 0x40000000 cubed is 2^90 — which is 2^26 once truncated to uint64, and passes any check made on the product. The bound has to be applied per axis, before the multiplication.

The limits (65536 per axis, 2^30 voxels) are far above what MagicaVoxel itself can author — 256 per axis — and exist only so malformed input cannot reach the arithmetic.

Verification

Found via a .vox robustness suite in ossia/score that derives malformed files from valid ones and loads each in a forked child. With this patch the crafted-SIZE case is rejected cleanly instead of corrupting the heap, and the suite is green at 3407 assertions.

Separately, and not part of this PR: consumers who override ogt_assert to be non-fatal — as the header documents — need to handle a scene coming back with an instance whose model_index is out of range, or whose model is NULL. That is caller-side; we handle it on our end.