read-n segfaults on a negative n and never checks its allocation

[hellerve]

BufReader_read_MINUS_n_ allocates n bytes without checking either the
argument or the result:

Array BufReader_read_MINUS_n_(BufReader* br, int n) {
  result.data = CARP_MALLOC(n);
  ...
  while (result.len < n) {

result.len is size_t and n is int, so the comparison converts n to
size_t: a negative n becomes a huge bound and the loop keeps copying into a
buffer that was never allocated. CARP_MALLOC's result is not checked either.

bufio.carp passes n straight through, so this is reachable from
(BufReader.read-n &br -1):

[RUNTIME ERROR] 'out/Untitled' exited with return value -11.

Reproduced on main at fc49035, before the #4 growth hardening, so it is not a
regression from that PR — it is the allocation site #4 did not cover.

Fix is a guard on n < 0 (error, or clamp to zero) plus a NULL check on the
allocation, in the shape bufio_reserve already uses.

[ethanhawkes-gif]

Opened #8 for this. Root cause is exactly as you diagnosed: CARP_MALLOC(n) is unchecked and the loop bound result.len < n compares a size_t against an int, so n = -1 becomes a huge bound and copies into a buffer that was never allocated. The fix returns the empty array for a non-positive n (which the read-n wrapper already maps to Result.Error "connection closed"), NULL-checks the allocation in the shape bufio_reserve uses, and compares against (size_t)n. The positive-n path is untouched.

To try it before merge:

git fetch https://github.com/ethanhawkes-gif/bufio fix/read-n-negative-count
git checkout FETCH_HEAD -- src/bufio.h test/bufio.carp
carp -x test/bufio.carp

I reproduced the segfault directly against src/bufio.h with a small harness supplying the Array/CARP_MALLOC shims: under -fsanitize=address,undefined, (read-n, -1) on a non-empty stream aborts at bufio.h:148 (requested allocation size 0xffffffffffffffff). After the fix, read-n(-1) and read-n(0) return an empty array with no ASan/UBSan report, while read-n(5) → hello and read-n(100) → hello world are byte-for-byte unchanged. Added a regression case beside the existing read-n empty-stream test.