fix: cap VecOf pre-allocation to prevent OOM on malformed input

A crafted event log with a large count (e.g. 0xFFFFFFFF) could cause
Vec::with_capacity to attempt allocating ~4GB before any decode occurs.
Cap the pre-allocation to 1024; the Vec will still grow as needed via
push if the actual count is larger.

Author: kvinwang

cc-eventlog/src/codecs.rs

@@ -25,7 +25,7 @@ impl<I: Decode + Into<u32> + Copy, T: Decode> Decode for VecOf<I, T> {
     fn decode<In: Input>(input: &mut In) -> Result<Self, scale::Error> {
         let decoded_len = I::decode(input)?;
         let len = decoded_len.into() as usize;
-        let mut inner = Vec::with_capacity(len);
+        let mut inner = Vec::with_capacity(len.min(1024));
         for _ in 0..len {
             inner.push(T::decode(input)?);
         }