win: add overflow check in search_path_join_test()

The allocation size for the joined path is computed as a sum of multiple
lengths multiplied by sizeof(WCHAR). On 32-bit systems, if path
components are long enough, the sum or the multiplication can wrap
size_t, producing a tiny allocation. The subsequent wcsncpy calls then
write past the buffer end.

Add overflow checks for both the addition and the multiplication before
allocating.

src/win/process.c

@@ -186,8 +186,15 @@ static WCHAR* search_path_join_test(const WCHAR* dir,
   }
 
   /* Allocate buffer for output */
-  result = result_pos = (WCHAR*)uv__malloc(sizeof(WCHAR) *
-      (cwd_len + 1 + dir_len + 1 + name_len + 1 + ext_len + 1));
+  {
+    size_t alloc_len = cwd_len + 1 + dir_len + 1 + name_len + 1 + ext_len + 1;
+    if (alloc_len > SIZE_MAX / sizeof(WCHAR) ||
+        alloc_len < cwd_len /* overflow in the addition */) {
+      SetLastError(ERROR_OUTOFMEMORY);
+      return NULL;
+    }
+    result = result_pos = (WCHAR*)uv__malloc(sizeof(WCHAR) * alloc_len);
+  }
 
   /* Copy cwd */
   wcsncpy(result_pos, cwd, cwd_len);