parser lyb BUGFIX bound memory input reads

[Alearner12]

Summary

Harden memory-backed LYB parsing against out-of-bounds reads caused by truncated or lengthless binary input.

This PR now targets devel and has been adapted to the LYB error handling and bounded-memory parsing support already present there.

Problem

LYB is a binary format and may contain embedded NULL bytes. Memory input created with ly_in_new_memory() has no explicit length, so it cannot safely represent an LYB buffer.

Additionally, using length == 0 to mean “unbounded” makes it impossible to safely represent a bounded zero-length buffer. Some cursor calculations could also underflow if the current position moved beyond the input boundary.

Malformed LYB schema hashes could reach assertion-only checks, causing the process to abort instead of returning a parser error.

Changes

• Add an explicit bounded flag to struct ly_in.
• Mark file and file-descriptor inputs as bounded.
• Make ly_in_read(), ly_in_peek(), and ly_in_skip() safely validate bounded reads and cursor movement.
• Correctly support bounded zero-length memory input.
• Reset the bounded state when replacing memory with ly_in_memory().
• Mark input created by the existing lyd_parse_data_mem_len() wrapper as bounded.
• Change lyd_parse_data_mem_len() length from size_t to uint32_t, as requested in review.
• Propagate the remaining unchecked lyb_read_size() failure.
• Report truncated LYB input as a validation error.
• Convert malformed schema-hash collision and prefix assertions into validation errors.
• Adapt the existing lyd_parse_lyb fuzz target to exercise bounded memory parsing directly.
• Update affected unit tests to use exact binary output lengths.

Compatibility

Callers must not use the NULL-terminated memory API for binary LYB data:

lyd_parse_data_mem(ctx, data, LYD_LYB, ...);

They should use the existing bounded-memory API instead:

lyd_parse_data_mem_len(ctx, data, data_len, LYD_LYB, ...);

Text-format memory parsing remains unchanged.

Testing

Local verification:

• Configured and built the complete project with tests enabled.
• Compiled all available unit-test targets successfully.
• Ran all 18 directly affected unit-test suites.
• Result: 18 passed, 0 failed.
• Verified valid bounded LYB input parses successfully.
• Verified zero-length and truncated bounded LYB input fails cleanly.
• Verified the diff has no whitespace errors.

CBOR-specific tests were not available locally because libcbor was not installed; CI will provide the remaining platform and optional-dependency coverage.

[michalvasko]

Please look at the current devel branch and make changes accordingly, I do not have anything against this PR in general. That is exactly why the README mentions the devel branch for any development tasks and that it should be the target for all PRs.

[Alearner12]

@michalvasko Updated the existing PR to target devel and adapted the implementation to the current code.

Since devel already includes most LYB read-error propagation and lyd_parse_data_mem_len(), I removed the duplicate API and parser changes. The updated PR keeps the remaining security fixes:

• distinguishes bounded inputs, including zero-length buffers;
• safely checks reads and skips without arithmetic underflow;
• rejects unbounded memory-backed LYB input;
• propagates the remaining unchecked LYB size read;
• converts malformed schema-hash assertions into validation errors;
• updates the existing LYB fuzz target and affected unit tests.

I also changed data_len to uint32_t as requested.

The project builds successfully and all 18 affected test suites pass. Please review the updated version when convenient.

[michalvasko]

Seems fine except for one issue, thanks.

[Alearner12]

@michalvasko Removed the unbounded memory-input rejection as requested, preserving compatibility with sysrepo and existing callers. I also updated the regression test to verify that the legacy unbounded LYB path remains supported, while bounded zero-length and truncated inputs still fail safely. Please take another look when convenient. Thanks

[michalvasko]

Seems okay, just one minor issue.

[michalvasko]

Missing function doxygen.