Fix integer overflow in LSTM Convolve and Reconfig deserialization

[stweil]

Add range and overflow validation in Convolve::DeSerialize and Reconfig::DeSerialize to prevent a crafted .traineddata file from triggering a heap out-of-bounds write via unchecked signed integer multiplication when computing the output-channel count.

Validate ni/no/num_weights in Network::CreateFromFile.

Add defense-in-depth bounds assertions in NetworkIO::Randomize and NetworkIO::CopyTimeStepGeneral.

Assisted-by: OpenCode / big-pickle (opencode)

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 duplication

Metric	Results
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (2)

src/lstm/networkio.cpp:412

• The new bounds assert is incomplete and can still allow out-of-bounds memory access: negative dest_offset/src_offset or num_features will pass dest_offset + num_features <= NumFeatures(), and the addition itself can overflow. Also, there is no corresponding bounds assertion for the source range. Use non-negative checks and subtraction-based bounds (and validate both dest and src) to avoid overflow and underflow.

This issue also appears on line 417 of the same file.

void NetworkIO::CopyTimeStepGeneral(int dest_t, int dest_offset, int num_features,
                                    const NetworkIO &src, int src_t, int src_offset) {
  ASSERT_HOST(int_mode_ == src.int_mode_);
  ASSERT_HOST(dest_offset + num_features <= NumFeatures());
  if (int_mode_) {
    memcpy(i_[dest_t] + dest_offset, src.i_[src_t] + src_offset, num_features * sizeof(i_[0][0]));
  } else {
    memcpy(f_[dest_t] + dest_offset, src.f_[src_t] + src_offset, num_features * sizeof(f_[0][0]));

src/lstm/networkio.cpp:420

• The new bounds assert in Randomize can still allow out-of-bounds writes when offset or num_features is negative, and offset + num_features can overflow. Prefer non-negative checks and subtraction-based bounds to avoid overflow/underflow.

void NetworkIO::Randomize(int t, int offset, int num_features, TRand *randomizer) {
  ASSERT_HOST(offset + num_features <= NumFeatures());
  if (int_mode_) {
    int8_t *line = i_[t] + offset;

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[stweil]

@EunhoKim98, please review and test if possible.

[EunhoKim98]

"Thanks Stefan — I reviewed the fix and it looks solid. It covers everything raised in the report. PR #4588 and version 5.5.3 look good to go. Thanks again for the quick turnaround — please feel free to request the CVE when you're ready."