Fix integer overflow in BitBufferMut::collect_bool, truncate, and append_n

Signed-off-by: Sungjin Kim <carp1230@gmail.com>

Author: ksj1230

vortex-buffer/src/bit/buf_mut.rs

@@ -186,7 +186,8 @@ impl BitBufferMut {
     /// Invokes `f` with indexes `0..len` collecting the boolean results into a new `BitBufferMut`
     #[inline]
     pub fn collect_bool<F: FnMut(usize) -> bool>(len: usize, f: F) -> Self {
-        let num_words = len.div_ceil(64);
+        let num_words = len.checked_add(63)
+    		.expect("collect_bool: len overflow") / 64;
         let mut buffer: BufferMut<u64> = BufferMut::with_capacity(num_words);
         // SAFETY: `collect_bool_words` writes every word in `0..num_words` below
         // before any read; `u64` has no invalid bit patterns and the assignments
@@ -376,7 +377,8 @@ impl BitBufferMut {
             return;
         }
 
-        let end_bit = self.offset + len;
+        let end_bit = self.offset.checked_add(len)
+    		.expect("BitBufferMut::truncate: offset + len overflow");
         let new_len_bytes = end_bit.div_ceil(8);
         self.buffer.truncate(new_len_bytes);
         self.len = len;
@@ -442,7 +444,9 @@ impl BitBufferMut {
             return;
         }
 
-        let end_bit_pos = self.offset + self.len + n;
+        let end_bit_pos = self.offset.checked_add(self.len)
+			.and_then(|v| v.checked_add(n))
+			.expect("BitBufferMut::append_n: offset + len + n overflow");
         let required_bytes = end_bit_pos.div_ceil(8);
 
         // Ensure buffer has enough bytes