feat(error): populate decode/encode error offsets from cursor positions

[Greg Lamberson (glamberson)]

Depends on #1266. This PR stacks on the foundational reshape; the GitHub diff will collapse once #1266 merges. Both branches share base commit e935058c.

Summary

Audit-driven workspace sweep populating the offset field on every decode and encode error variant introduced by #1266. Where #1266 documented 0 as the "offset unknown" sentinel and left existing call sites passing it, this PR walks the workspace and replaces it with cursor.pos() wherever a ReadCursor or WriteCursor is in lexical scope.

Kept separate from #1266 so the foundational error-shape change stays a reviewable single-purpose PR.

Methodology

Per-site classification, not a heuristic substitution. For each call site that touches the new offset parameter:

1. Find the immediate enclosing fn (brace-depth walk, not a regex over the file).
2. Inspect that fn's signature for a &mut ReadCursor<...> or &mut WriteCursor<...> parameter.
3. If exactly one cursor is in scope, substitute its actual parameter name (the BER routines use stream, for example, not src).
4. If no cursor is in scope, leave the site at at: 0,. The function genuinely has no buffer to position-from.
5. If the site is inside a macro_rules! body, handle the macro individually (adapt its signature to accept an offset, update each caller with the offset reachable at that call site).

Audit script lives in the PR description history if you want to reproduce: walks all at: 0, macro forms plus direct calls to invalid_field_err(..., 0), unexpected_message_type_err(..., 0), unsupported_value_err(..., 0), and invalid_field_err_with_source(..., 0, e).

Coverage

408 call sites reviewed in total:

Category	Count	Disposition
Macro form at: 0, in a cursor-bearing fn	333	Upgraded to in: <cursor> using the parameter's actual name
Macro form at: 0, with no cursor in the enclosing fn	57	Left at at: 0 (try_from impls on enum discriminants, new/with_* constructors, accessors on already-decoded structs, dimension validators, find_size(&[u8]))
Inside a macro_rules! body	9	Local macros adapted; see "Macro adapters" below
Direct function-call sites the macro-form audit missed	9	8 upgraded to cursor.pos(), 1 (find_size) stays 0

Macro adapters

Three local helper macros hardcoded 0 as the offset and were invoked from multiple call sites with differing cursor availability. Each macro was adapted to take an explicit offset argument; each caller now passes either 0 (no cursor in scope) or cursor.pos() (cursor in scope):

• validate_dimensions! in ironrdp-displaycontrol/src/pdu/mod.rs. Two callers: constructor passes 0, decode passes src.pos().
• check_masks_alignment! in ironrdp-pdu/src/basic_output/pointer/mod.rs. Four callers, all inside encode or decode methods.
• per_field_err! in ironrdp-pdu/src/mcs.rs. This one captures cursor position into the returned closure (move |error| invalid_field_err_with_source(..., offset, error)) so PER read/write failures carry the byte offset of the field that failed. All 26 callers updated to pass in: src, or in: dst, depending on whether they're in a per::read_* or per::write_* chain.

Foundation-crate macro tightening

The bare forms of three macros were removed so the discipline is enforced at compile time rather than reviewed by hand:

• ensure_size!: lost its bare buffer form; the remaining form always extracts $buf.pos(). To make this work, encode_string was refactored from dst: &mut [u8] to dst: &mut WriteCursor<'_>. The two callers using the slice form (cliprdr/format_data/file_list.rs and rdp/capability_sets/input.rs) were updated to pass the cursor directly and use write_padding! for fixed-width fields. This is the only user-visible API change in this PR.
• cast_length! and cast_int!: lost their bare forms. Callers must pick in: <cursor> to extract the position or at: <offset> to pass one explicitly. Doc comments updated.

Test snapshots

expect_test fixtures that print full Error debug output were regenerated via UPDATE_EXPECT=1 and now record the real byte offsets where decode failures originate. Examples:

Test	New offset
pcb::null_size	4 (after the u32 cbSize read)
pcb::truncated	16
pcb::pcb_v2_string_too_big	18
x224::nego_request_unexpected_rdp_msg_type	35
x224::nego_confirm_unexpected_rdp_msg_type	12
x224::cookie_without_cr_lf_error_decode	20

Diff

Single commit deb0ac85 on top of #1266's e935058c. 101 files changed, +788 / -796 (the negative delta is real: removing the bare-form macro arms shrinks macros.rs, and many call sites became shorter after the cursor extraction).

CI

cargo xtask check fmt | lints | locks | typos | tests green. cargo test --workspace --exclude ironrdp-web --exclude ironrdp-bench --tests green.

Refs #1266, #1120.

[Benoît Cortier (CBenoit)]

note: Here, we are using 0 for the offset because there is no relevant byte offset. In fact, we’re not even decoding anything, suggesting this function should not really return a DecodeResult. It’s fine to keep it that way with a dummy value for now, but we need to keep this in mind when performing this migration: we’ll have to change the error type of some functions, and we should not accomodate them too much in DecodeErrorKind