fix integer overflow in midi parser sample count calculation (bug #200)

[sezero]

This fixes the 'impossibly long duration with crafted midi file' issue
as reported in bug #200. Midi file to test:
https://github.com/SegfaultMasters/covering360/raw/master/wildmidi/1_hang_main_00

Notes:

• About arbitrary upper bounds for unacceptable delta (as noted in impossibly long duration with crafted midi file #200):
  I changed the smallest_delta initializer from 0xffffffff to 0x7fffffff
  i.e. I decided to use INT32_MAX instead of UINT32_MAX as a reasonable
  upper bound. Rest of the integer overflow checks rely on multiplication
  errors against INT32_MAX.

• Overflow location was discovered when playing with clang's undefined
  behavior sanitizer.

• This does not do anything about the issue reported at bug issue with MIDI_0088.MID and MIDI_0089.HMI from Daggerfall #176.

Comments? @chrisisonwildcode, what do you say?

Please review thoroughly. I'm willing to revise according to critisisms.

[psi29a]

Thanks for taking this on @sezero
I'm wondering if we should start collecting these midi files for integration testing (and smoke test) so that we don't regress when changing things in the future.

And yes, ubsan is great. :)

[sezero]

Thanks for taking this on @sezero

You're welcome

I'm wondering if we should start collecting these midi files for integration testing (and smoke test) so that we don't regress when changing things in the future.

Attaching the relevant bad midi here, then
1_hang_main_00.zip

And yes, ubsan is great. :)

Yeah. (The clang version helped me though, the gcc version did not..)

Should I merge?

[psi29a]

Yes, please merge.

This just covers up the problem though, there are very real issues though I think in our parser, like the HMI support and daggerfall files.

[sezero]

Merged.
Backported to wildmidi-0.3 too: 775894c

[sezero]

This just covers up the problem though, there are very real issues though I think in our parser, like the HMI support and daggerfall files.

Well, the daggerfall files (#176) I still don't know why 0.3 branch is good but 0.4 is trouble..

As for hmi and hmp: PING #181 :) Please?