Prevent overflow errors, and add a correctness comment

api/src/sign/mod.rs

@@ -78,7 +78,11 @@ pub fn gather_signature_data(
         return Err(SignaturesError::Empty.into());
     }
 
-    let signature_bytes = HEADER_SIZE + keys.len() * SIGNATURE_LENGTH;
+    let signature_bytes = keys
+        .len()
+        .checked_mul(SIGNATURE_LENGTH)
+        .and_then(|s| s.checked_add(HEADER_SIZE))
+        .ok_or(SignaturesError::TooManyKeys)?;
     if signature_bytes > BUF_LIMIT {
         return Err(SignaturesError::TooManyKeys.into());
     }

api/src/sign/zip.rs

@@ -41,7 +41,11 @@ where
     if keys.len() > SignatureCountLeInt::MAX as usize {
         return Err(Error::TooManyKeys.into());
     }
-    let signature_bytes = SIGNATURE_LENGTH * keys.len() + HEADER_SIZE;
+    let signature_bytes = keys
+        .len()
+        .checked_mul(SIGNATURE_LENGTH)
+        .and_then(|s| s.checked_add(HEADER_SIZE))
+        .ok_or(Error::TooManyKeys)?;
     if signature_bytes > BUF_LIMIT {
         return Err(Error::TooManyKeys.into());
     }

api/src/verify/mod.rs

@@ -105,7 +105,9 @@ where
     if signature_count == 0 {
         return Err(SignaturesError::Empty.into());
     }
-    let signature_bytes = signature_count * SIGNATURE_LENGTH;
+    let signature_bytes = signature_count
+        .checked_mul(SIGNATURE_LENGTH)
+        .ok_or(SignaturesError::MagicHeader)?;
     if signature_bytes > BUF_LIMIT {
         return Err(SignaturesError::MagicHeader.into());
     }

api/src/verify_unsign_tar.rs

@@ -98,6 +98,12 @@ where
     if data[..GZIP_START.len()] != *GZIP_START {
         return Err(TarReadSignaturesError::Gzip);
     }
+    // `base64` already ensures that no `NUL` was contained in the input. A `NUL` would mean that
+    // the signature data was broken / contained inside another `DEFLATE` block. I don't think
+    // forging a `.tar.gz` file this way could be used for an attack, anyway, because an empty
+    // `DEFLATE` block cannot contain data. Being "empty" and "containing data" at the same time …
+    // But without any `NUL` check, `zipsign-api` could possibly say "this file is fine", when it's
+    // actually broken.
     let Ok(data) = BASE64_STANDARD.decode(&data[GZIP_START.len()..]) else {
         return Err(TarReadSignaturesError::Base64);
     };