fix(svta): bound the svta ts option to uint32

CodeQL flagged the ts=<n> option as an incorrect integer conversion: strconv.Atoi
returns a platform-width int, so a value above 2^32-1 was silently truncated when
assigned to the uint32 EventStream@timescale (ts=4294967296 became 0, ts=4294967297
became 1). Use the existing parseUint32 helper, which parses with an explicit 32-bit
bound, and reject anything outside it.

Author: tobbee

cmd/livesim2/app/svta.go

@@ -110,11 +110,13 @@ func CreateSVTAConfig(val string) (*SVTAConfig, error) {
 		case "pod":
 			cfg.Pod, err = parseSVTABool("pod", v)
 		case "ts":
-			n, err := strconv.Atoi(v)
-			if err != nil || n <= 0 {
-				return nil, fmt.Errorf("svta ts %q: must be > 0", v)
+			// parseUint32 bounds the value to the uint32 the EventStream@timescale is,
+			// so a huge value is rejected rather than silently truncated.
+			n, err := parseUint32(v)
+			if err != nil || n == 0 {
+				return nil, fmt.Errorf("svta ts %q: must be a positive 32-bit integer", v)
 			}
-			cfg.Timescale = uint32(n)
+			cfg.Timescale = n
 		default:
 			return nil, fmt.Errorf("unknown svta param %q", key)
 		}

cmd/livesim2/app/svta_test.go

@@ -59,7 +59,10 @@ func TestCreateSVTAConfig(t *testing.T) {
 		{desc: "ads too high", val: "30:15;ads=21", err: `svta ads "21": must be 1-20`},
 		{desc: "negative skip", val: "30:15;skip=-1", err: `svta skip "-1": must be >= 0`},
 		{desc: "bad click", val: "30:15;click=yes", err: `svta click "yes": must be 0 or 1`},
-		{desc: "bad timescale", val: "30:15;ts=0", err: `svta ts "0": must be > 0`},
+		{desc: "zero timescale", val: "30:15;ts=0", err: `svta ts "0": must be a positive 32-bit integer`},
+		{desc: "negative timescale", val: "30:15;ts=-1", err: `svta ts "-1": must be a positive 32-bit integer`},
+		{desc: "timescale overflowing uint32", val: "30:15;ts=4294967296",
+			err: `svta ts "4294967296": must be a positive 32-bit integer`},
 	}
 	for _, c := range cases {
 		t.Run(c.desc, func(t *testing.T) {