Require size_t to be at least 32 bits

docs/changelog.md

@@ -18,6 +18,7 @@ Note: releases are listed from latest to oldest.
 - Added and improved some safety checks that detect maliciously-crafted and other pathological files
 - Added detection for empty GIF files (erroring out with `PLUM_ERR_NO_DATA` instead of `PLUM_ERR_INVALID_FILE_FORMAT`)
 - Improved PNG compression by fixing a lookback bug in the compressor
+- Added and documented a restriction requiring `size_t` to be at least 32 bits wide
 - Some minor documentation updates and code cleanup
 
 ## Version 0.3 (10 January 2022)

docs/conventions.md

@@ -42,6 +42,8 @@ here for completeness.
   This is enforced by the usage of the `uint8_t` type.
 - The system uses two's complement for signed numbers.
   This is enforced by the usage of the `int16_t` type.
+- The `size_t` type is at least 32 bits wide.
+  This is checked when compiling the library.
 - All data pointers ("object pointers" in the standard's parlance) have the same representation; in other words, you
   can copy one pointer into another and access it that way (assuming the pointer is properly aligned).
   This in turn implies that, if a union contains pointers as members, a value assigned to one of those members can be

src/defs.h

@@ -2,12 +2,16 @@
 
 #define PLUM_DEFS
 
+#include <stdint.h>
+
 #if defined(PLUM_NO_STDINT) || defined(PLUM_NO_ANON_MEMBERS) || defined(PLUM_NO_VLA)
   #error libplum feature-test macros must not be defined when compiling the library.
 #elif defined(__cplusplus)
   #error libplum cannot be compiled with a C++ compiler.
 #elif __STDC_VERSION__ < 201710L
   #error libplum requires C17 or later.
+#elif SIZE_MAX < 0xffffffffu
+  #error libplum requires size_t to be at least 32 bits wide.
 #endif
 
 #ifdef noreturn