Reject overflowing integers in bytecode reader

[carrerasdarren-cell]

Summary

• decode positive int fields through a uint32_t temporary
• reject unsigned LEB128 values above INT_MAX before assigning signed bytecode fields
• add a regression for the overflowing constant-pool count from [Bug]Heap-buffer-overflow WRITE in JS_ReadFunctionTag: negative count wraps the allocation size below the header size (CWE-787) #549

Problem

bc_get_leb128_int() previously wrote an unsigned LEB128 value directly through an int *. Values above INT_MAX therefore became negative. In JS_ReadFunctionTag(), a negative count could wrap the allocation-size calculation below the bytecode-function header size before the header copy.

The shared decoder now raises a SyntaxError for values that cannot be represented by its positive int callers. This also removes the incompatible pointer cast.

Fixes #549.

Testing

• make -j4 test
• make -j4 CONFIG_ASAN=y CONFIG_UBSAN=y test
• exact 21-byte reproducer: baseline reports a 96-byte heap-buffer-overflow write; patched build rejects it with SyntaxError: integer overflow while reading bytecode