fix(fuse): reject overflowing write endpoints (#1393)

[RPG-Nia]

Summary

Fixes overflowing FUSE write endpoint handling.

Issue Describe / Design

Closes #1393

Root cause:

• The FUSE write path validates the offset and write length separately.
• However, FuseWriter did not validate offset + data.len() before enqueueing a write task.
• The writer worker later updated cached file length using unchecked addition, which could overflow when the offset is close to i64::MAX.

Fix approach:

• Add checked write endpoint calculation in FuseWriter.
• Reject overflowing write endpoints before enqueueing.
• Return EFBIG through the existing FsError::InvalidFileSize to FUSE errno mapping.
• Reuse the checked endpoint when updating cached file length.
• Add regression tests for maximum valid endpoint, overflow rejection, and unchanged writer status after rejection.

Changes

Module / File	Change	Impact on existing behavior
curvine-fuse/src/fs/fuse_writer.rs	Add checked arithmetic for offset + data.len() before enqueueing writes.	Invalid overflowing writes are rejected early and no longer enter the writer queue.
curvine-fuse/src/fs/fuse_writer.rs	Replace unchecked cached length update with the checked write endpoint.	Cached file length is no longer updated through overflowing arithmetic.
curvine-fuse/src/fs/fuse_writer.rs	Add boundary regression tests for valid and overflowing endpoints.	Covers EFBIG mapping and verifies rejected writes do not change write_ver or cached file length.

Test verified

Test case	Result	Notes
Rust format / diff check	PASS	Ran cargo fmt --check and git diff --check successfully.
FUSE writer endpoint boundary tests	PASS	Ran cargo test --offline -p curvine-fuse checked_write_end -- --nocapture successfully.
FUSE writer rejection behavior test	PASS	Ran cargo test --offline -p curvine-fuse overflowing_write_endpoint_is_rejected_before_enqueue -- --nocapture successfully.
FUSE writer regression tests	PASS	Ran cargo test --offline -p curvine-fuse fuse_writer -- --nocapture successfully.

Dependencies

• Related PRs: None
• Related issues: [BUG]: Reject overflowing FUSE write end offsets [LiAuto] #1393
• Blocks / blocked by: None

[Copilot]

Pull request overview

This PR fixes a potential integer overflow in the FUSE write path by ensuring the write endpoint (offset + data.len()) is computed with checked arithmetic and rejected early if it overflows, preventing corrupted cached file length updates and ensuring the error maps to EFBIG via FsError::InvalidFileSize.

Changes:

• Added FuseWriter::checked_write_end(off, len) to compute off + len safely and return FsError::InvalidFileSize on overflow.
• Validated write endpoints in FuseWriter::write() before enqueueing, and reused the checked endpoint when updating cached file_len.
• Added regression tests covering maximum valid endpoint, overflow rejection (EFBIG), and ensuring rejected writes do not mutate write_ver or cached length.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.