Envisat: fix heap overflow in ScanForGCPs_ASAR from unchecked NUM_DSR

[saddamr3e]

What does this PR do?

EnvisatDataset::ScanForGCPs_ASAR() sizes the GCP array from the NUM_DSR field of the GEOLOCATION GRID ADS descriptor:

pasGCPList = (GDAL_GCP *)CPLCalloc(sizeof(GDAL_GCP), (nNumDSR + 1) * 11);

nNumDSR is taken verbatim from the dataset descriptor and (nNumDSR + 1) * 11 is evaluated as int. A large declared count overflows: (390451572 + 1) * 11 wraps to 7, so the array is under-allocated while the per-record loop keeps writing 11 GCPs per record through GDALInitGCPs() past the end of the buffer.

It triggers on a small crafted .N1 with a single 521-byte geolocation record and NUM_DSR=390451572. With -ftrapv (GDAL Debug builds) the multiply traps; without it AddressSanitizer reports:

ERROR: AddressSanitizer: heap-buffer-overflow ... WRITE of size 56
    #1 GDALInitGCPs gdal_misc.cpp:1884
    #2 EnvisatDataset::ScanForGCPs_ASAR() envisatdataset.cpp:335
    #3 EnvisatDataset::Open(GDALOpenInfo*) envisatdataset.cpp:1140
0x... is located 0 bytes after 392-byte region
allocated by ... EnvisatDataset::ScanForGCPs_ASAR() envisatdataset.cpp:313

The fix stays in the callee: reject a NUM_DSR that cannot fit the declared dataset size, and compute the array size in size_t, the same way ScanForGCPs_MERIS() already does. Valid products read identically; the added test builds a well-formed geolocation grid that still yields 33 GCPs.

What are related issues/pull requests?

None. Found by review of the GCP collection paths.

AI tool usage

• AI (Y-a-t-il-un-Copilot-dans-l'avion, Chat-j'ai-pété, Jean-Claude Dusse or something similar) supported my development of this PR. See our policy about AI tool use. Use of AI tools must be indicated.

Tasklist

• Make sure code is correctly formatted (cf pre-commit configuration)
• Add test case(s)
• Add documentation
• Updated Python API documentation (swig/include/python/docs/)
• Review
• Adjust for comments
• All CI builds and checks have passed

Environment

• OS: any
• Compiler: any

[coveralls]

coverage: 73.764% (+0.06%) from 73.706% — saddamr3e:envisat-gcp-num-dsr-overflow-pr into OSGeo:master