gh-134070: Prevent out-of-bounds read in mi_clz32 and mi_ctz32

[vedant713]

FixesGH-134070

Summary:
This patch adds a masking operation to the index calculation in mi_ctz32() and mi_clz32() functions to prevent out-of-bounds access on 64-bit systems, matching the fix from upstream mimalloc.

Why:
On systems where unsigned long is 64-bit, the multiplication may produce a value >31, causing a read outside the array bounds.

[bedevere-app]

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.

[ZeroIntensity]

Please add a test and blurb.

[collinfunk]

FYI, this code is from https://github.com/microsoft/mimalloc. You might want to send a pull request there too.

[picnixz]

It's said to be fixed in microsoft/mimalloc@ed31847.

[bedevere-app]

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.

[picnixz]

Please, stop updating two PRs at the same time. See https://devguide.python.org/getting-started/pull-request-lifecycle/. I am going to close the other PR as it only contains the NEWS entry. In addition, please do not merge main into this branch if there is no conflict. TiA.

[vedant713]

I'm trying to add via heroku app but giving server error
bedevere/news
bedevere/news — No news entry in Misc/NEWS.d/next/ or "skip news" label found

[picnixz]

I never used the app, so I'd suggest using the command-line instead:

python -m pip install blurbpython -m blurbgit commit -m 'blurb'

[collinfunk]

@picnixz Thanks for checking. Somehow I missed that commit in mimalloc.

[colesbury]

I think we should copy-paste the change from upstream instead of doing a similar (but not identical) fix here.

In other words, copy this code from upstream (from the fix commit) into our mimalloc/internal.h file.

https://github.com/microsoft/mimalloc/blob/ed318471126918fce7caf0001cf1e0c78f95173e/include/mimalloc/internal.h#L875-L932

[picnixz]

@vedant713 Are you still working on this one?

[github-actions]

This PR is stale because it has been open for 30 days with no activity.