Fix build under CAPNP_DEBUG_TYPES.

c++/src/capnp/message.c++

@@ -242,8 +242,10 @@ MallocMessageBuilder::~MallocMessageBuilder() noexcept(false) {
 }
 
 kj::ArrayPtr<word> MallocMessageBuilder::allocateSegment(uint minimumSize) {
-  KJ_REQUIRE(minimumSize <= MAX_SEGMENT_WORDS, "MallocMessageBuilder asked to allocate segment above maximum serializable size.");
-  KJ_ASSERT(nextSize <= MAX_SEGMENT_WORDS, "MallocMessageBuilder nextSize out of bounds.");
+  KJ_REQUIRE(bounded(minimumSize) * WORDS <= MAX_SEGMENT_WORDS,
+      "MallocMessageBuilder asked to allocate segment above maximum serializable size.");
+  KJ_ASSERT(bounded(nextSize) * WORDS <= MAX_SEGMENT_WORDS,
+      "MallocMessageBuilder nextSize out of bounds.");
 
   if (!returnedFirstSegment && !ownFirstSegment) {
     kj::ArrayPtr<word> result = kj::arrayPtr(reinterpret_cast<word*>(firstSegment), nextSize);
@@ -283,7 +285,8 @@ kj::ArrayPtr<word> MallocMessageBuilder::allocateSegment(uint minimumSize) {
     if (allocationStrategy == AllocationStrategy::GROW_HEURISTICALLY) {
       // set nextSize = min(nextSize+size, MAX_SEGMENT_WORDS)
       // while protecting against possible overflow of (nextSize+size)
-      nextSize = (size <= MAX_SEGMENT_WORDS-nextSize) ? nextSize+size : MAX_SEGMENT_WORDS;
+      nextSize = (size <= unbound(MAX_SEGMENT_WORDS / WORDS) - nextSize)
+          ? nextSize + size : unbound(MAX_SEGMENT_WORDS / WORDS);
     }
   }