fix(carbonio): validate machoNet oob length against payload size

[Rakdos8]

Summary

Closes a network-reachable heap over-read in the machoNet stream packet parser.

Problem

m_oobDataLen is read from the wire (attacker-controlled out-of-band length
prefix). It was only bounded by maxPacketSize, never by the payload actually
received. A hostile peer could announce an m_oobDataLen larger than the
received buffer, causing m_payload to advance past m_data, the
payloadLen() - m_oobDataLen computation to underflow, and adjacent heap
memory to be handed to the oob callbacks / returned to Python.

Fix

After the existing maxPacketSize guard, reject any packet whose oob block
plus its 4-byte length prefix exceeds payloadLen(). Same style as the
sibling check (PyErr_Format + return false), no behavioural change for
well-formed packets.

Type

Security — remote heap over-read / information disclosure (Critical).

Testing

Manual review; behaviour for valid packets unchanged (guard only rejects
malformed oversized oob lengths).

[CCP-Aporia]

Hi @Rakdos8

Thank you for the PR and apologies for the late response. We are still in the process of sorting out some details around contribution guidelines and PR templates.

This does indeed look like a real issue. Could you please add a test case in tests/python/carboniotests/test/test_socket.py as well?

[Rakdos8]

Hi @Rakdos8

Thank you for the PR and apologies for the late response. We are still in the process of sorting out some details around contribution guidelines and PR templates.

This does indeed look like a real issue. Could you please add a test case in tests/python/carboniotests/test/test_socket.py as well?

No worries about the delay : I can imagine open-sourcing a project isn't easy, especially sorting out contribution guidelines and templates along the way 😉

Done : added test_recvpacket_with_oob_data_exceeding_payload to CarbonIoTest in tests/python/carboniotests/test/test_socket.py. It hand-crafts a packet whose advertised OOB length overruns the received payload and asserts recvpacketoob() raises OSError, exercising the new bound. It sits alongside the existing test_recvpacket_with_oob_data happy-path case.