From 8bc7de35f987bce3f1704b17c5cda5634af35c7b Mon Sep 17 00:00:00 2001
From: Rangi <sylvie.oukaour+rangi42@gmail.com>
Date: Sat, 22 Aug 2026 18:24:17 -0400
Subject: [PATCH] Prevent `SECTION FRAGMENT` combined sizes from overflowing
 their `uint16_t` size

---
 src/link/section.cpp                             | 9 +++++++++
 test/link/section-fragment/size-overflow/a.asm   | 2 ++
 test/link/section-fragment/size-overflow/out.err | 5 +++++
 test/link/test.sh                                | 8 ++++++++
 4 files changed, 24 insertions(+)
 create mode 100644 test/link/section-fragment/size-overflow/a.asm
 create mode 100644 test/link/section-fragment/size-overflow/out.err

diff --git a/src/link/section.cpp b/src/link/section.cpp
index 907535ec..2d5b1658 100644
--- a/src/link/section.cpp
+++ b/src/link/section.cpp
@@ -146,6 +146,15 @@ static void mergeSections(Section &target, std::unique_ptr<Section> &&other) {
 
 	case SECTION_FRAGMENT:
 		checkPieceCompat(target, *other, target.size);
+		// Check that `target.size += other->size` below will not overflow
+		if (target.size + other->size > UINT16_MAX) {
+			fatalTwoAt(
+			    target,
+			    *other,
+			    "Section \"%s\" fragments combined are larger than the GB address space",
+			    target.name.c_str()
+			);
+		}
 		// Append `other` to `target`
 		other->offset = target.size;
 		target.size += other->size;
diff --git a/test/link/section-fragment/size-overflow/a.asm b/test/link/section-fragment/size-overflow/a.asm
new file mode 100644
index 00000000..75ba522a
--- /dev/null
+++ b/test/link/section-fragment/size-overflow/a.asm
@@ -0,0 +1,2 @@
+SECTION FRAGMENT "output", ROM0
+ds $4000
diff --git a/test/link/section-fragment/size-overflow/out.err b/test/link/section-fragment/size-overflow/out.err
new file mode 100644
index 00000000..f7ca1e38
--- /dev/null
+++ b/test/link/section-fragment/size-overflow/out.err
@@ -0,0 +1,5 @@
+FATAL: Section "output" fragments combined are larger than the GB address space
+    at section-fragment/size-overflow/a.asm(1)
+    and also:
+    at section-fragment/size-overflow/a.asm(1)
+Linking aborted with 1 error
diff --git a/test/link/test.sh b/test/link/test.sh
index f1f48656..fe1cb17b 100755
--- a/test/link/test.sh
+++ b/test/link/test.sh
@@ -398,6 +398,14 @@ rgblinkQuiet -o "$gbtemp" "$otemp" "$gbtemp2"
 tryCmpRom "$test"/ref.out.bin
 evaluateTest
 
+test="section-fragment/size-overflow"
+startTest
+"$RGBASM" -o "$otemp" "$test"/a.asm
+continueTest
+rgblinkQuiet "$otemp" "$otemp" "$otemp" "$otemp" 2>"$outtemp"
+tryDiff "$test"/out.err "$outtemp"
+evaluateTest
+
 test="section-fragment/jr-offset"
 startTest
 "$RGBASM" -o "$otemp" "$test"/a.asm