Bound every array a data file can index

Closes Defects items 16 and 17 and Known-and-still-open item 6. All three let
an asset file, or a caller's argument, write past a fixed array.

akgl_sprite_load_json took its frame count straight from the document and wrote
that many entries into a 16-byte frameids -- through a uint32_t * cast of a
uint8_t *, so each write touched four bytes and the overrun reached four bytes
past the array, into the rest of akgl_Sprite and then the next pool slot. The
count is checked first now, each id is read into an int and narrowed
deliberately, and a frame number too large for a uint8_t is refused rather than
truncated into an index for a different tile.

The tilemap loader had the same shape twice: objects[j] with no check against
AKGL_TILEMAP_MAX_OBJECTS_PER_LAYER and tilesets[i] with none against
AKGL_TILEMAP_MAX_TILESETS. akgl_tilemap_load_layers already bounded its own
loop, so the pattern was in the same file. The object one is the reachable
half -- 128 objects is not a large object layer.

akgl_string_initialize zeroed sizeof(akgl_String) starting at `data`, which
begins after the refcount in front of it, so it ran four bytes past the end of
the object and onto the *next* slot's refcount -- the field the allocator reads
to decide whether a slot is free. Same file, same class, fixed with it:
akgl_string_copy accepted a count larger than the buffers, reading past one
pool slot and writing past another, which the header documented as behaviour.

Every case has a test that fails against the old code, with five new fixtures.
Exactly-the-maximum is asserted alongside one-past in each, so the bound cannot
be fixed by making the limit off by one.

25/25 pass, memcheck clean, reindent --check clean.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/staticstring.c

@@ -130,6 +130,111 @@ void reset_string_heap(void)
     }
 }
 
+/**
+ * @brief akgl_string_initialize must not write past the buffer it is zeroing.
+ *
+ * The `NULL` init path zeroed `sizeof(akgl_String)` bytes starting at `data`.
+ * `data` begins after the `int refcount` in front of it, so that ran four bytes
+ * past the end of the object -- straight onto the *next* pool slot's refcount,
+ * which is the field the allocator uses to decide whether a slot is free.
+ *
+ * Claiming two adjacent slots and initializing the first is enough to catch it:
+ * the second's refcount goes to zero and the pool believes it is free while the
+ * caller is still holding it.
+ */
+akerr_ErrorContext *test_akgl_string_initialize_stays_in_bounds(void)
+{
+    PREPARE_ERROR(errctx);
+    akgl_String *first = NULL;
+    akgl_String *second = NULL;
+
+    ATTEMPT {
+	CATCH(errctx, akgl_heap_next_string(&first));
+	CATCH(errctx, akgl_heap_next_string(&second));
+	TEST_ASSERT(errctx, second == (first + 1),
+		    "the pool did not hand out adjacent slots; this test needs them");
+
+	// A sentinel the overrun would land on. akgl_heap_next_string has
+	// already set it to 1; make it something an accidental write cannot
+	// coincide with.
+	second->refcount = 0x5A;
+
+	CATCH(errctx, akgl_string_initialize(first, NULL));
+
+	TEST_ASSERT(errctx, second->refcount == 0x5A,
+		    "initializing a string wrote past its buffer: the next slot's "
+		    "refcount is %d, expected %d",
+		    second->refcount, 0x5A);
+	TEST_ASSERT(errctx, first->refcount == 1,
+		    "initializing a string left its own refcount at %d, expected 1",
+		    first->refcount);
+	TEST_ASSERT(errctx, first->data[0] == '\0',
+		    "initializing a string with NULL did not zero its buffer");
+	TEST_ASSERT(errctx, first->data[AKGL_MAX_STRING_LENGTH - 1] == '\0',
+		    "initializing a string with NULL did not zero its last byte");
+    } CLEANUP {
+	if ( second != NULL ) {
+	    second->refcount = 1;
+	    IGNORE(akgl_heap_release_string(second));
+	}
+	if ( first != NULL ) {
+	    IGNORE(akgl_heap_release_string(first));
+	}
+    } PROCESS(errctx) {
+    } FINISH(errctx, true);
+    SUCCEED_RETURN(errctx);
+}
+
+/**
+ * @brief akgl_string_copy must refuse a count that would leave both buffers.
+ *
+ * Both slots are exactly AKGL_MAX_STRING_LENGTH bytes, so a larger count read
+ * past the end of one and wrote past the end of the other. The header used to
+ * document that as behaviour.
+ */
+akerr_ErrorContext *test_akgl_string_copy_bounds_its_count(void)
+{
+    PREPARE_ERROR(errctx);
+    akgl_String *src = NULL;
+    akgl_String *dest = NULL;
+
+    ATTEMPT {
+	CATCH(errctx, akgl_heap_next_string(&src));
+	CATCH(errctx, akgl_heap_next_string(&dest));
+	CATCH(errctx, akgl_string_initialize(src, "bounded"));
+	CATCH(errctx, akgl_string_initialize(dest, NULL));
+
+	TEST_EXPECT_STATUS(errctx, AKERR_OUTOFBOUNDS,
+			   akgl_string_copy(src, dest, AKGL_MAX_STRING_LENGTH + 1),
+			   "copying one byte more than a pool string holds");
+	TEST_EXPECT_STATUS(errctx, AKERR_OUTOFBOUNDS,
+			   akgl_string_copy(src, dest, -1),
+			   "copying a negative number of bytes");
+
+	// The boundary itself is legal: it is exactly the buffer.
+	TEST_EXPECT_OK(errctx, akgl_string_copy(src, dest, AKGL_MAX_STRING_LENGTH),
+		       "copying exactly a pool string's length");
+	TEST_ASSERT(errctx, strcmp((char *)&dest->data, "bounded") == 0,
+		    "a full-length copy did not transfer the contents");
+
+	// 0 still means "the whole buffer" rather than "nothing".
+	CATCH(errctx, akgl_string_initialize(dest, NULL));
+	TEST_EXPECT_OK(errctx, akgl_string_copy(src, dest, 0),
+		       "copying with a count of zero");
+	TEST_ASSERT(errctx, strcmp((char *)&dest->data, "bounded") == 0,
+		    "a zero-count copy did not transfer the whole buffer");
+    } CLEANUP {
+	if ( dest != NULL ) {
+	    IGNORE(akgl_heap_release_string(dest));
+	}
+	if ( src != NULL ) {
+	    IGNORE(akgl_heap_release_string(src));
+	}
+    } PROCESS(errctx) {
+    } FINISH(errctx, true);
+    SUCCEED_RETURN(errctx);
+}
+
 int main(void)
 {
 
@@ -151,6 +256,12 @@ int main(void)
 	reset_string_heap();
 	printf("test_akgl_string_initialize....\n");
 	test_akgl_string_initialize();
+	reset_string_heap();
+	printf("test_akgl_string_initialize_stays_in_bounds ...\n");
+	CATCH(errctx, test_akgl_string_initialize_stays_in_bounds());
+	reset_string_heap();
+	printf("test_akgl_string_copy_bounds_its_count ...\n");
+	CATCH(errctx, test_akgl_string_copy_bounds_its_count());
     } CLEANUP {
     } PROCESS(errctx) {
     } FINISH_NORETURN(errctx);