[xhon-pelushi]

Problem

SanitizeOptions() clamps size options with ClipToRange():

template <class T, class V>
static void ClipToRange(T* ptr, V minvalue, V maxvalue) {
  if (static_cast<V>(*ptr) > maxvalue) *ptr = maxvalue;
  if (static_cast<V>(*ptr) < minvalue) *ptr = minvalue;
}
...
ClipToRange(&result.write_buffer_size, 64 << 10, 1 << 30);

write_buffer_size/max_file_size/block_size are size_t, but the bound literals are int, so V is int and static_cast<V>(*ptr) truncates. A write_buffer_size of 2 GiB casts to a negative int, so it is clamped to the minimum (64 KiB) rather than the 1 GiB maximum; values >= 4 GiB wrap modulo 2^32 (#462).

Fix

Compare in the pointee's type T, casting the bounds up to T:

if (*ptr > static_cast<T>(maxvalue)) *ptr = static_cast<T>(maxvalue);
if (*ptr < static_cast<T>(minvalue)) *ptr = static_cast<T>(minvalue);

All the min/max bounds here are positive, so casting them to size_t is well-defined, and int options (max_open_files) are unchanged.

Test

DBTest.SanitizeOptionsOverflow calls SanitizeOptions() with 2 GiB and 4 GiB sizes and asserts they clamp to the documented maxima (1 GiB / 4 MiB), plus a negative max_open_files clamping to the minimum. It fails on main (2 GiB clamps to the minimum) and passes with this change.

Fixes #462

The regression test is adapted from the earlier PR #1356, which the author self-closed.