Bound DDS cubemap counts before face-count conversion - #745

Summary

Bound the DX10 cubemap count to UINT16_MAX before multiplying it by six to obtain the face count. Counts above that limit return HRESULT_E_ARITHMETIC_OVERFLOW.

This follows the review clarification to bound the input cubemap count, not the resulting face count. The check remains after zero-count normalization and applies on both 32-bit and 64-bit targets, including when DDS_FLAGS_ALLOW_LARGE_FILES is enabled. This deliberately replaces the earlier machine-width-dependent representability check with a stricter, architecture-independent input limit.

The existing final hardware-limit checks remain unchanged: without the large-file option, the face count is still limited to 2048. With that option, an input count of 65535 remains acceptable to metadata parsing and yields 393210 faces; 65536 is rejected before multiplication. The accepted large boundary was tested through metadata parsing only, not image loading.

Validation

• Native x86 and x64 Release library builds passed.
• A focused local harness passed 23 named checks on each architecture: 11 ordinary/boundary checks and 12 fixture/API checks.
• Boundary checks cover zero/one-cube behavior, the existing 341/342-cube hardware boundary, and the new 65535/65536-cube boundary with default and large-file flags. Complete image loading is used only for the ordinary one-cube cases.
• The exact companion fixture returns arithmetic overflow from memory/file metadata and load APIs under default, large-file, and fuzz-stage flag combinations. The candidate load checks leave the image empty.
• Runs used a 256 MiB process-tree limit and a 90-second timeout. Library hashes were recorded before linking the harness, executable hashes before execution, and both were checked unchanged afterward.
• The repository's CI clang-format configuration and git diff --check pass.

Companion and limits

The maintained corpus fixture is proposed in walbourn/directxtextest#77. That PR replaces its earlier C++ helper with one small DDS file; this source PR contains no test-suite files.

The focused harness is local validation, not a full maintained-suite pass. Full-suite validation remains pending because the configured media corpus is unavailable locally. Historical validation of the earlier representability-only revision is not being presented as validation of this new policy. This is a correctness change, not a memory-safety or exploitability claim.