Look out for size-based calculations that break on integer overflow

[cabo]

e.g., (ws->offset + (sz) >= ws->size) (in ensure_writable)
This is unlikely to occur in normal practice, but could be used in an attack.