Modeling Algorithms - guard CreateSmoothed's fixed-stride shapes array against a section with more edges than section 1

[gsdali]

Description

BRepOffsetAPI_ThruSections::CreateSmoothed() derives nbEdges — the edge count it assumes
every section has — from section 1 alone (or section 2, if section 1 is a punctual/degenerate
vertex section). It then allocates shapes, an NCollection_Array1<TopoDS_Shape> sized exactly
nbSects * nbEdges, and fills it by walking each section's wire with a BRepTools_WireExplorer,
incrementing a running index with no bounds check.

Nothing enforces that every section actually has nbEdges edges. BRepFill_CompatibleWires (via
CheckCompatibility(true), the default) normally reconciles differing edge counts across sections
before CreateSmoothed() ever runs. With CheckCompatibility(false) ("no check"), that
reconciliation is skipped entirely, so a later section with more edges than section 1 makes the
fill loop walk past the end of shapes — an out-of-bounds write, observed as heap corruption and a
SIGSEGV/SIGBUS inside CreateSmoothed() once at least 3 sections are involved (2 sections always
take the CreateRuled() path instead, which does not share this allocation shape).

Confirmed via a minimal, from-scratch C++ reproducer with a custom signal handler
(backtrace_symbols_fd) for attribution: two matching circle sections build successfully; reusing
the same builder with a third, differently-shaped section (more edges than the first two) and
rebuilding SIGSEGVs against the stock library. It does not need a reused builder as such — what
actually varies is process/allocator state at the time of the overrun, so an otherwise-identical
single Build() call with all three sections added up front does not reliably crash even though
the same out-of-bounds write still occurs. Verified directly by instrumenting the fill loop: the
write index reaches one past shapes.Upper() before the corrupting assignment.

Fix

Before allocating shapes, walk every non-punctual section and count its edges; if any section's
count differs from nbEdges, set myStatus to BRepFill_ThruSectionErrorStatus_ProfilesInconsistent
and return, matching the early-return idiom this function already uses two lines below
(TS.IsNull() -> myStatus = Failed; return;). Punctual end sections (a degenerate vertex added
via AddVertex(), e.g. a cone's apex) are exempt, matching the existing w1Point/w2Point
handling throughout the rest of the function.

Testing

Two GTests added to the existing BRepOffsetAPI_ThruSections_Test.cxx:

• MismatchedSectionEdgeCountFailsCleanlyWithoutCheck — the crash reproducer. Proved it fails
  first: linked against the unpatched archive, this test crashes (SIGBUS). With the fix, it passes
  (IsDone() == false, no crash).
• MatchingSectionEdgeCountsStillSucceedWithoutCheck — regression guard: matching section edge
  counts under CheckCompatibility(false) still build, including a punctual end section.

All 5 tests in the file (the 3 pre-existing plus these 2) pass with the fix. Validated by
override-linking the patched translation unit ahead of the stock archive, both with and without
No_Exception/NDEBUG (matching a Release build configuration), confirming the fix eliminates the
out-of-bounds write itself rather than relying on Standard_OutOfRange's range check being
compiled in.

Formatted with this repo's own .clang-format (--dry-run --Werror clean on both changed files).