fix integer overflow in IOBuf::cloneCoalescedAsValueWithHeadroomTailroom

Summary:
Follow-up to D116335797, which fixed the integer-overflow → heap-buffer-overflow in `IOBuf::coalesceAndReallocate`. The sibling path `cloneCoalescedAsValueWithHeadroomTailroom` re-implements the same unchecked three-term sum `newLength + newHeadroom + newTailroom`, which wraps when attacker-controlled `headroom`/`tailroom` are forwarded through the public `cloneCoalesced*WithHeadroomTailroom` APIs, under-allocating the buffer and overflowing it while copying.

This guards the "Coalesce into newBuf" capacity with `checked_add` + `kMaxIOBufSize`, throwing `std::bad_alloc` on overflow — mirroring the existing idiom in `coalesceAndReallocate`. The unique_ptr wrapper forwards to the by-value overload, so both public entry points are covered. This re-applies the `clone` hunk from the reverted D115286348 while leaving the already-landed `coalesceAndReallocate` guard untouched.

Reviewed By: ilvokhin

Differential Revision: D116669664

fbshipit-source-id: 14f433f1793ad102ef97e66a7ac52d62ca5bb5a3

Author: yfeldblum

folly/io/IOBuf.cpp

@@ -860,7 +860,11 @@ IOBuf IOBuf::cloneCoalescedAsValueWithHeadroomTailroom(
 
   // Coalesce into newBuf
   const std::size_t newLength = computeChainDataLength();
-  const std::size_t newCapacity = newLength + newHeadroom + newTailroom;
+  std::size_t newCapacity = 0;
+  if (!checked_add(&newCapacity, newLength, newHeadroom, newTailroom) ||
+      newCapacity > kMaxIOBufSize) {
+    throw_exception<std::bad_alloc>();
+  }
   IOBuf newBuf{CREATE, newCapacity};
   newBuf.advance(newHeadroom);
 

folly/io/test/IOBufTest.cpp

@@ -1589,6 +1589,22 @@ TEST(IOBuf, CoalesceCapacityOverflow) {
   EXPECT_THROW(head->coalesceWithHeadroomTailroom(kMax, kMax), std::bad_alloc);
 }
 
+// cloneCoalescedAsValueWithHeadroomTailroom (and the unique_ptr wrapper that
+// forwards to it) must throw std::bad_alloc when the coalesced capacity
+// overflows size_t rather than wrapping around to an undersized buffer.
+TEST(IOBuf, CloneCoalescedCapacityOverflow) {
+  auto head = fromStr("hello");
+  head->insertAfterThisOne(fromStr("world"));
+  ASSERT_TRUE(head->isChained());
+
+  constexpr auto kMax = std::numeric_limits<std::size_t>::max();
+  EXPECT_THROW(
+      head->cloneCoalescedWithHeadroomTailroom(kMax, kMax), std::bad_alloc);
+  EXPECT_THROW(
+      head->cloneCoalescedAsValueWithHeadroomTailroom(kMax, kMax),
+      std::bad_alloc);
+}
+
 TEST(IOBuf, CloneCoalescedChain) {
   auto b = IOBuf::createChain(1000, 100);
   b->advance(10);