query: check the additions a hostile msgpack length drives

[EnRaiha]

query: check the additions a hostile msgpack length drives

Why

The reader module documents "Returns None on truncated/invalid data — never
panics", and four sites broke that contract by adding a length read from the
input to a header width in plain usize:

• the STR32, BIN32 and EXT32 arms of skip_value
• start + len in the string read path

5 + 0xffff_ffff fits in a 64-bit usize, so the buffer check rejects it and
the value is discarded as intended. On a 32-bit target the addition overflows
first and the process aborts with attempt to add with overflow — a hostile
frame turning a decode failure into a crash.

What changed

checked_advance_len performs both additions checked, and checked_advance,
read_u16_be, read_u32_be, read_u64_be, read_str, read_str_advance,
read_bin_advance, the field index and the field lookup all route through it.
Every header/len pair was checked against its tag width; none changed value.

Strictly narrower input is rejected. No input that was accepted before is
rejected now.

Steps to test

cargo nextest run -p nodedb-query -E 'test(fuzz_adversarial_length_fields)'

The existing adversarial-length test already covers all four sites. It is the
red arm on a 32-bit target and green on a 64-bit one either side of the change,
which is why the defect survived:

target	fix reverted	fix applied
wasm32-wasip1	FAILED — attempt to add with overflow	PASS
x86_64	PASS	PASS

Run it under a 32-bit target to see the failure:

CARGO_TARGET_WASM32_WASIP1_RUNNER="wasmtime -W max-wasm-stack=33554432 --dir=." \
  cargo nextest run --profile ci --target wasm32-wasip1 -p nodedb-query \
  -E 'test(fuzz_adversarial_length_fields)'

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[EnRaiha]

Closing: the linked issue is closed. The finding itself is hostile-input hardening on 32-bit usize, not wasm work. If the maintainer wants it, it returns as a fresh PR with that framing.