fix(cli): parse_unsigned negative/overflow guards + --help in cli_parse.cpp (ADR-1088)

[lusoris]

Summary

• parse_unsigned silently accepted -1: strtoul("-1") wraps to ULONG_MAX without ERANGE; the *end=='\0' guard passed, so --frame_cnt -1 stored UINT_MAX in settings->frame_cnt, causing the frame loop to attempt ~4 billion iterations. Fix: reject any optarg whose first character is '-' before calling strtoul.
• parse_unsigned silently accepted >32-bit values on 64-bit hosts: strtoul("5000000000") returns 5 000 000 000 without error; the (unsigned) cast silently wraps to 705 032 704. Fix: check ul > UINT_MAX after strtoul.
• --help missing from production binary: cli_parse.cpp (compiled since ADR-0809) lacked ARG_HELP / --help; vmaf --help fell into getopt's unknown-option path and printed a confusing mandatory-argument error. Ported from cli_parse.c.

Both overflow/negative paths emit "Invalid argument … should be an integer in [0, 2^32-1]" and exit(1), consistent with every other bad-input path.

Changed files

File	Change
core/tools/cli_parse.cpp	Add cerrno/climits includes; parse_unsigned leading-'-' + ul > UINT_MAX guards; ARG_HELP enum value + long_opts[] entry + case ARG_HELP: arm + usage text line
core/tools/cli_parse.c	Same parse_unsigned guards (used by unit test target)
core/test/test_cli_parse_long_only_args.c	Five new fork/waitpid regression tests: --frame_cnt -1, --frame_skip_ref -5, --frame_skip_dist -1, --frame_cnt 5000000000, --threads -1
core/tools/AGENTS.md	Invariant note for the new guards
docs/adr/1088-r14-cli-flag-parsing.md	Decision record
docs/adr/README.md	Index row
changelog.d/fixed/1088-…md	Fragment
docs/rebase-notes.md	Entry
docs/state.md	Recently closed row

Test plan

• meson test -C build test_cli_parse_long_only_args — five new tests + four existing (--threads abc, --subsample xyz, --cpumask qqq, --th=foosoxe) must pass
• meson test -C build test_cli_parse — existing aom_ctc / backend / no_reference tests must be unaffected
• vmaf --help prints help text and exits 0 (production binary only — cli_parse.cpp)
• vmaf --frame_cnt -1 … prints Invalid argument "-1" and exits 1
• vmaf --frame_cnt 5000000000 … prints Invalid argument "5000000000" and exits 1

Deliverables checklist (ADR-0108)

• Research digest — no digest needed: trivial (two-guard parse hardening)
• Decision matrix — in ADR-1088 ## Alternatives considered
• AGENTS.md invariant note — in core/tools/AGENTS.md
• Reproducer / smoke-test command — vmaf --frame_cnt -1 -r ref.y4m -d dis.y4m → exit 1 + "Invalid argument"
• CHANGELOG fragment — changelog.d/fixed/1088-cli-parse-unsigned-overflow-negative-help.md
• Rebase note — docs/rebase-notes.md entry

no rebase impact: changes confined to cli_parse.c, cli_parse.cpp, and test_cli_parse_long_only_args.c. No public API, no header, no model, no upstream-mirrored file is modified.

🤖 Generated with Claude Code