fix(util): reject oversize length in binary message decoders

[dxbjavid]

Wrapping length check in the binary decoders
The bounds check in tDecodeBinaryWithSize reads as pCoder->pos + size > pCoder->size, but pos and size are both uint32_t so the addition is done in 32 bits and wraps. size arrives from a varint in the message via tDecodeBinary, so a length close to UINT32_MAX (encoded as ff ff ff ff 0f) makes the sum wrap below size and the check passes. The decoder then returns a pointer with that oversize length and advances pos past the end of the buffer, so the next read runs out of bounds. I switched the four binary decoders that take a message-supplied length to the non-wrapping form size > pCoder->size - pCoder->pos, which is safe because pos never exceeds size.

[gemini-code-assist]

Code Review

This pull request refactors the bounds checking logic in several binary decoding functions within include/util/tencode.h (specifically tDecodeBinaryWithSize, tDecodeBinaryTo, tDecodeBinaryAlloc, and tDecodeBinaryAlloc32). The checks are updated from pCoder->pos + size > pCoder->size to size > pCoder->size - pCoder->pos to prevent potential integer overflow vulnerabilities. There are no review comments, and I have no feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[dxbjavid]

Hi maintainers,

Just a friendly follow-up on this PR. When you have a chance, could you please provide an update on its review status?

Happy to make any additional changes if needed.

Thank you!

[CLAassistant]

All committers have signed the CLA.

[dxbjavid]

CLA done!