embeddedfs/vmdk: cap stream marker data size and footer sector count to prevent OOM

[adilburaksen]

Summary

Two unchecked allocations in the stream-optimized VMDK parser allow a crafted
file to exhaust process memory.

Bug 1: — unchecked uint32

allocates make([]byte, size) where size is a
uint32 field read directly from the untrusted marker header.

Craft: 1036-byte VMDK with stream marker size = 0xffffffff.
Effect: 4 GB heap allocation. The function returns nil (silent OOM)
because the subsequent io.ReadFull returns io.EOF which the caller
treats as end-of-stream.

Confirmed live:

TotalAlloc delta: 4096 MB   (1036-byte input, nil error returned)

Bug 2: FOOTER marker — unchecked val * SectorSize allocation

The case 3 (FOOTER) handler allocates
make([]byte, int64(val*SectorSize)) where val is a uint64
sector count from the marker header — no bounds check.

Craft: set val = 0x100000 (1M sectors × 512 = 512 MB).
Confirmed live: TotalAlloc delta ~512 MB.

Fix

1. Add const maxMarkerDataBytes = 64 << 20 (64 MB) guard in
   readStreamMarker before make([]byte, size).
2. Add const maxFooterSectors = 4 guard in the FOOTER switch case
   before make([]byte, val*SectorSize). Footer headers are always
   512 bytes (1 sector); 4 sectors is generous.

Tests

• TestConvertVMDKStreamMarkerSizeRejected: 1036-byte bomb, expects
  error + TotalAlloc delta < 50 MB.
• TestConvertVMDKFooterSectorCountRejected: 1040-byte FOOTER bomb,
  expects error + TotalAlloc delta < 50 MB.

All existing VMDK tests continue to pass.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[adilburaksen]

/gcbcla check

[adilburaksen]

Hi! Just a friendly ping — all CI checks are passing. Happy to address any review feedback whenever you get a chance. Thanks for your time!