Summary

calc_size_items() in py/modstruct.c accumulates the total buffer size
for a struct format string into a size_t variable without any overflow
check. On 32-bit targets where size_t is 4 bytes -- ESP32, RP2040,
STM32, SAMD21/51, nRF52 -- a format string such as '1500000000I'
silently wraps the accumulator from ~6 GB back to a small positive value.
vstr_init_len() allocates only that small buffer. When
struct_pack_into_internal() writes the real payload it walks far past
the end of the allocation, corrupting the MicroPython heap.

On embedded targets there is no ASLR, no heap canary, and no MMU
protection between heap regions, so the corruption is reachable from pure
Python with no native-code access required:

import struct
struct.calcsize('1500000000I')  # silently returns 4 on 32-bit
struct.pack('1500000000I', 0)   # writes ~6 GB into a 4-byte buffer

The fix adds a single pre-loop overflow guard in calc_size_items():

if (sz > 0 && cnt > (SIZE_MAX - size) / sz) {
    mp_raise_ValueError(MP_ERROR_TEXT("pack format too large"));
}

sz equals align for every MicroPython struct format code (all
primitive types), so consecutive items of the same type add exactly sz
bytes each. The check is therefore exact for all single-type format
strings and conservative (safe) for mixed layouts.

Testing

I reproduced the overflow by compiling a standalone C harness with a
uint32_t accumulator to simulate 32-bit size_t (gcc -O2). The buggy
path allocates 4 bytes and then attempts a ~6 GB write; the fixed path
raises immediately with no allocation.

A regression test is added at tests/basics/struct_overflow.py. On
32-bit targets the test expects ValueError, OverflowError, or
MemoryError to be raised. On 64-bit hosts SIZE_MAX is large enough
that a uint32_t repeat count cannot trigger the overflow, so the test
prints SKIP and exits early.

Tested on: unix port x86-64 (test prints SKIP as expected). The fix
targets 32-bit embedded ports; I do not have physical hardware available,
but the guard path is straightforward and covered by the simulated
experiment.

Trade-offs and Alternatives

Code size increase is 32--80 bytes depending on target (see CI code size
report). The added cost is one integer division per format specifier.
Because sz is always a power of two for every MicroPython struct format
code, the compiler can replace the division with a right shift on
architectures that support it, making the runtime cost negligible.

An alternative per-iteration check (if (size + sz < size) overflow)
would be simpler but would fire on mixed-type format strings where
alignment padding temporarily makes size + sz non-monotone. The
pre-loop check is safe for all layouts.

Generative AI

I used generative AI tools when creating this PR, but a human has checked
the code and is responsible for the code and the description above.