Move ceil call back into the geometric sampler.

Test exactly what the geometric sampler returns, because that's what
the downstream callers of it are going to use.

While here, also assert that the geometric sampler returns a positive
integer.  (Our geometric distribution is the one suported on {1, 2,
3, ...} that returns the number of trials before the first success,
not the one supported on {0, 1, 2, ...} that returns the number of
failures before the first success.)

src/lib/math/prob_distr.c

@@ -1308,7 +1308,7 @@ sample_geometric(uint32_t s, double p0, double p)
   if (p >= 1)
     return 1;
 
-  return (-x/log1p(-p));
+  return ceil(-x/log1p(-p));
 }
 
 /*******************************************************************/

src/test/test_prob_distr.c

@@ -958,7 +958,17 @@ test_stochastic_geometric_impl(double p)
     size_t C[PSI_DF] = {0};
 
     for (j = 0; j < NSAMPLES; j++) {
-      double n_tmp = ceil(geometric_sample(p));
+      double n_tmp = geometric_sample(p);
+
+      /* Must be an integer.  (XXX -Wfloat-equal)  */
+      tor_assert(ceil(n_tmp) <= n_tmp && ceil(n_tmp) >= n_tmp);
+
+      /* Must be a positive integer.  */
+      tor_assert(n_tmp >= 1);
+
+      /* Probability of getting a value in the billions is negligible.  */
+      tor_assert(n_tmp <= (double)UINT_MAX);
+
       unsigned n = (unsigned) n_tmp;
 
       if (n > PSI_DF)