harden: wrap oversized declared size as ZstdException; test bomb handling

Zstd.decompress(byte[]) reads the (untrusted) content size from the frame header
to size its output. A header declaring more than Integer.MAX_VALUE bytes
previously let a raw ArithmeticException escape from Math.toIntExact; it now
fails with a ZstdException naming the limit and pointing to decompress(byte[],
int) for bounded, untrusted-safe decoding.

Adds ZstdTest.UntrustedInput documenting decompression-bomb behaviour:
- decompress(byte[], maxSize) refuses a tiny frame that expands to 8 MiB,
- decompress(byte[]) trusts the declared size and expands fully (so untrusted
  callers must pass a bound),
- a hand-built frame header declaring > 2 GiB throws ZstdException, not
  ArithmeticException.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: dfa1

CHANGELOG.md

@@ -38,6 +38,10 @@ git tags, which trigger publication to Maven Central.
   `ZstdDictionary.id()`, `ZstdCompressDict.id()`, `ZstdDecompressDict.id()`,
   `ZstdFrame.dictId(...)`, and `ZstdFrameHeader.dictId()`. The `0` sentinel is now
   `ZstdDictionaryId.NONE`, and the id reads as unsigned via `value()`.
+- `Zstd.decompress(byte[])` now throws `ZstdException` (instead of letting a raw
+  `ArithmeticException` escape) when a frame declares a content size larger than a
+  Java array can hold. The size comes from the untrusted frame header; use
+  `decompress(byte[], int)` to bound output for untrusted input.
 
 ## [0.5]
 

zstd/src/main/java/io/github/dfa1/zstd/Zstd.java

@@ -60,7 +60,23 @@ public static byte[] compress(byte[] src, int level) {
     public static byte[] decompress(byte[] compressed) {
         Objects.requireNonNull(compressed, "compressed");
         long size = requireStoredContentSize(frameContentSize(compressed));
-        return decompress(compressed, Math.toIntExact(size));
+        return decompress(compressed, toArrayLength(size));
+    }
+
+    /// Narrows a frame-declared content size to a `byte[]` length, rejecting sizes
+    /// that exceed what a Java array can hold. The size comes from the (untrusted)
+    /// frame header, so this fails with a [ZstdException] rather than letting a raw
+    /// `ArithmeticException` escape.
+    ///
+    /// @param size a non-negative content size from a frame header
+    /// @return `size` as an `int`
+    /// @throws ZstdException if `size` exceeds [Integer#MAX_VALUE]
+    private static int toArrayLength(long size) {
+        if (size > Integer.MAX_VALUE) {
+            throw new ZstdException("decompressed size " + size
+                    + " exceeds the maximum array length; use decompress(byte[], int) to bound it");
+        }
+        return (int) size;
     }
 
     /// Decompresses a zstd frame into a buffer of at most `maxSize` bytes.

zstd/src/test/java/io/github/dfa1/zstd/ZstdTest.java

@@ -256,4 +256,64 @@ private static byte[] standardDict(int id) {
             return d;
         }
     }
+
+    @Nested
+    class UntrustedInput {
+
+        @Test
+        void boundedDecompressRefusesADecompressionBomb() {
+            // Given a tiny frame that expands enormously (8 MiB of zeros -> a few bytes)
+            byte[] bomb = Zstd.compress(new byte[8 * 1024 * 1024]);
+            assertThat(bomb.length).isLessThan(1024); // huge amplification ratio
+
+            // When decompressed with a small bound (the safe path for untrusted input)
+            ThrowingCallable result = () -> Zstd.decompress(bomb, 64 * 1024);
+
+            // Then it is refused instead of allocating the full expansion
+            assertThatThrownBy(result).isInstanceOf(ZstdException.class);
+        }
+
+        @Test
+        void unboundedDecompressTrustsTheDeclaredSize() {
+            // Given the same tiny, highly amplifying frame
+            byte[] bomb = Zstd.compress(new byte[8 * 1024 * 1024]);
+
+            // When decompressed without a bound
+            byte[] out = Zstd.decompress(bomb);
+
+            // Then it expands fully — documenting that this overload trusts the frame
+            // header; untrusted callers must use decompress(byte[], maxSize)
+            assertThat(out).hasSize(8 * 1024 * 1024);
+        }
+
+        @Test
+        void rejectsAFrameDeclaringMoreThanArrayMaxWithoutLeakingArithmeticException() {
+            // Given a frame header that declares a content size above Integer.MAX_VALUE
+            byte[] frame = frameHeaderDeclaringContentSize(3_000_000_000L);
+
+            // When decompressed via the size-trusting overload
+            ThrowingCallable result = () -> Zstd.decompress(frame);
+
+            // Then it fails with a ZstdException, not a raw ArithmeticException
+            assertThatThrownBy(result)
+                    .isInstanceOf(ZstdException.class)
+                    .hasMessageContaining("exceeds the maximum array length");
+        }
+
+        // A minimal single-segment zstd frame header (magic + descriptor + 8-byte
+        // Frame_Content_Size) declaring `contentSize`; enough for the content-size
+        // read, which happens before any block is decoded.
+        private static byte[] frameHeaderDeclaringContentSize(long contentSize) {
+            byte[] f = new byte[13];
+            f[0] = (byte) 0x28;             // magic 0xFD2FB528, little-endian
+            f[1] = (byte) 0xB5;
+            f[2] = (byte) 0x2F;
+            f[3] = (byte) 0xFD;
+            f[4] = (byte) 0xE0;             // descriptor: FCS_flag=3 (8 bytes) | single-segment
+            for (int i = 0; i < 8; i++) {  // 8-byte little-endian content size
+                f[5 + i] = (byte) (contentSize >>> (8 * i));
+            }
+            return f;
+        }
+    }
 }