Validate deserialized fields in MergingDigest.fromBytes()

[August829]

Summary

Fixes #227: MergingDigest.fromBytes(ByteBuffer) reads compression, n, bufferSize, and lastUsedCell from untrusted input without any validation, allowing crafted byte sequences to crash the JVM thread with NegativeArraySizeException or ArrayIndexOutOfBoundsException.

This PR adds comprehensive input validation to both VERBOSE_ENCODING and SMALL_ENCODING paths:

• compression must be in (0, 1e9] to prevent integer overflow in array sizing
• n / bufferSize / lastUsedCell must be non-negative and cross-validated against each other
• centroid count must not exceed the buffer's remaining bytes (16 bytes per centroid for VERBOSE, 8 for SMALL)
• centroid count must not exceed the digest's internal array capacity
• All weights must be positive
• Centroid means must be in non-decreasing order (as the maintainer requested)
• Total weight must be >= centroid count (sanity check, as requested)

All invalid inputs now throw IllegalArgumentException with descriptive messages instead of crashing with raw RuntimeException subclasses.

Test plan

• 9 new @Test(expected = IllegalArgumentException.class) tests covering:
  • SMALL_ENCODING with negative n
  • VERBOSE_ENCODING with n exceeding array capacity
  • VERBOSE_ENCODING with overflow-inducing compression (1e10)
  • VERBOSE_ENCODING with negative compression
  • VERBOSE_ENCODING with negative weight
  • VERBOSE_ENCODING with decreasing centroid means
  • SMALL_ENCODING with lastUsedCell > n
  • SMALL_ENCODING with negative weight
  • SMALL_ENCODING with decreasing centroid means
• 2 round-trip tests (VERBOSE and SMALL) confirming valid digests still serialize/deserialize correctly
• Run full test suite (CI) to verify no regressions

🤖 Generated with Claude Code

[August829]

Hi @tdunning ,

Thanks for the reply. I’ve submitted a pull request. One more suggestion: could you set up a SECURITY.md to allow more private vulnerability submissions?