Fix two ice protocol connection bugs

[pepone]

Fixes icerpc/icerpc-csharp-audit#19.
Fixes icerpc/icerpc-csharp-audit#32.

Two small fixes in IceProtocolConnection:

• Missing lower-bound check on the ice frame size (audit C# should prefer string interpolation to concatenation #19): ReadFramesAsync validated only FrameSize > _maxFrameSize. A Request/Reply prologue with FrameSize smaller than the prologue size (14) made frameSize - PrologueSize negative, which threw ArgumentOutOfRangeException from ReadOnlySequence.Slice and reached the Debug.Fail in the generic exception handler — an assertion failure on untrusted input in debug builds. The lower bound is now rejected as InvalidDataException (malformed peer input), like the upper bound.

• Reply frame reader leak on a cancellation race (audit Remove Value factories, protected keyword and postMarshal/perUnmarshal callbacks #32): when the read frames loop completes responseCompletionSource with the reply frame reader (transferring ownership — the loop no longer completes it) and the invocation's WaitAsync(invocationCts.Token) observes cancellation in that same window, the reader was discarded without Complete(): the frame reader pipe's rented MemoryPool<byte> segments were never returned. The invocation's finally now completes the reader when the completion source holds a reader that was never retrieved (!responseCreated && frameReader is null). This also covers the read-loop-wins micro-race against the finally's own TrySetResult.

Tests

• Receiving_a_frame_smaller_than_the_prologue_size_aborts_the_connection: a server-side duplex read decorator rewrites the incoming request's frame size to 0; the connection aborts with ConnectionAborted. Without the fix this test fails with the exact failure mode from the audit: ArgumentOutOfRangeException from Slice reaching Debug.Fail in ReadFramesAsync.
• The Remove Value factories, protected keyword and postMarshal/perUnmarshal callbacks #32 race window (response landing in the completion source in the same instant the invocation observes cancellation) cannot be reached deterministically from a test — the fix is in the finally's already-completed branch and is covered by review plus the existing suite (all response/cancellation paths still pass).

Full IceRpc.Tests suite passes (988 passed / 0 failed), dotnet build and dotnet format --verify-no-changes clean.

[Copilot]

Pull request overview

This PR addresses two robustness issues in IceProtocolConnection: validating malformed frame sizes early to avoid debug assertions/crashes on untrusted input, and ensuring reply frame readers are always completed to prevent pooled buffer leaks during a narrow cancellation race.

Changes:

• Reject incoming Ice frames whose FrameSize is smaller than IceDefinitions.PrologueSize, treating it as malformed peer input.
• Fix a cancellation race by completing a reply PipeReader when it was produced by the read loop but never retrieved by the canceled invocation.
• Add a regression test that corrupts the incoming request prologue’s frame size to verify the connection aborts cleanly.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
tests/IceRpc.Tests/IceProtocolConnectionTests.cs	Adds a regression test for receiving a frame smaller than the Ice prologue size.
src/IceRpc/Internal/IceProtocolConnection.cs	Adds a lower-bound FrameSize check and completes leaked reply frame readers on a cancellation race.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.