sd-bus: add asserts for message size overflow safety

Coverity flags arithmetic in BUS_MESSAGE_SIZE(),
BUS_MESSAGE_BODY_BEGIN() and message_from_header() as potential
overflows. The values are validated at message creation time, but
add asserts to make the invariants explicit for static analyzers.

CID#1548023
CID#1548030
CID#1548046

Follow-up for 6629161f82

src/libsystemd/sd-bus/bus-message.c

@@ -362,6 +362,8 @@ static int message_from_header(
 
         if (label) {
                 label_sz = strlen(label);
+                /* Silence static analyzers */
+                assert(label_sz <= SIZE_MAX - ALIGN(sizeof(sd_bus_message)) - 1);
                 a += label_sz + 1;
         }
 

src/libsystemd/sd-bus/bus-message.h

@@ -153,6 +153,9 @@ static inline uint64_t BUS_MESSAGE_COOKIE(sd_bus_message *m) {
 }
 
 static inline size_t BUS_MESSAGE_SIZE(sd_bus_message *m) {
+        /* Silence static analyzers */
+        assert(ALIGN8(m->fields_size) <= SIZE_MAX - sizeof(BusMessageHeader));
+        assert(m->body_size <= SIZE_MAX - sizeof(BusMessageHeader) - ALIGN8(m->fields_size));
         return
                 sizeof(BusMessageHeader) +
                 ALIGN8(m->fields_size) +
@@ -160,6 +163,8 @@ static inline size_t BUS_MESSAGE_SIZE(sd_bus_message *m) {
 }
 
 static inline size_t BUS_MESSAGE_BODY_BEGIN(sd_bus_message *m) {
+        /* Silence static analyzers */
+        assert(ALIGN8(m->fields_size) <= SIZE_MAX - sizeof(BusMessageHeader));
         return
                 sizeof(BusMessageHeader) +
                 ALIGN8(m->fields_size);