fix(platform-wallet-ffi): bound bincode decode size on asset-lock proof bytes

[Claudius-Maginificent]

TL;DR: Bounds the size of asset-lock proof data decoded at the platform-wallet FFI boundary, so a malicious or malformed input can't exhaust memory before it's even validated.

User story

As an app developer integrating the platform-wallet FFI, I want asset-lock proof decoding to reject oversized input up front, so a malformed or hostile proof can't stall or crash my app via unbounded memory allocation.

Scenario

Base flow

A host app passes raw asset-lock proof bytes across the FFI boundary; the FFI decodes them with bincode before further processing.

Actual behavior

The decode was unbounded. A crafted byte sequence — including one with an oversized internal length prefix — could make bincode attempt to allocate gigabytes before erroring: a memory-exhaustion DoS vector at the FFI boundary.

Expected behavior

Proof bytes over 16 MiB are rejected immediately with the existing ErrorInvalidParameter code, before any decode is attempted. The bincode decode itself is also bounded (with_limit::<MAX>()), so a hostile length prefix inside an otherwise-valid-sized buffer can't over-allocate either.

Detailed discussion

What was done

Split out of #3968 (rs-platform-wallet-storage PR) as part of a coordinated PR-splitting effort — see that PR's description for the full breakdown. This change is fully independent of the storage crate: packages/rs-platform-wallet-ffi/src/asset_lock/sync.rs gains MAX_ASSET_LOCK_PROOF_SIZE_BYTES = 16 MiB, a validate_asset_lock_proof_size gate checked before from_raw_parts, and bincode::config::standard().with_limit::<MAX>() on the decode call. Reuses the pre-existing ErrorInvalidParameter FFI code — no new discriminants, no ABI surface change.

Testing

New unit test asserting oversized proof bytes are rejected before decode is attempted (cargo nextest -p platform-wallet-ffi, passes). cargo clippy -p platform-wallet-ffi --all-targets clean. cargo fmt --check clean.

Breaking changes

None — no new error codes, no signature changes.

Checklist

• I have performed a self-review of my own code
• I have added or updated relevant unit tests
• No breaking changes
• No documentation changes needed

Prior work

Split out of #3968 as part of a coordinated 4-PR split (PR 0 = trimmed #3968, this PR, plus two more for typed persister errors and FFI/misc fixes). See #3968 for the full rationale.

_{🤖 Co-authored by Claudius the Magnificent AI Agent}

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}