boundary handling and decompression limits in CompressedRTF

[jmestwa-coder]

Summary

This patch strengthens CompressedRTF boundary handling and decompression validation for both compressed and uncompressed RTF streams.

Changes

• Enforce maximum decompressed size validation using IOUtils.safelyAllocateCheck.
• Add bounded output enforcement to prevent expansion beyond the declared decompressed size plus documented protocol padding.
• Fix uncompressed RTF handling to:
  • copy only the declared payload bytes,
  • stop at the correct stream boundary,
  • and avoid falling through into LZW decompression.
• Bound compressed input reads to the declared compressed payload size using BoundedInputStream.
• Add documentation for the MS-OXRTFCP trailing padding behavior.

Tests

Added tests covering:

• rejection of oversized declared decompressed sizes,
• rejection of malformed compressed streams expanding beyond allowed padding limits.

[pjfanning]

why this length as opposed to some other value?

[jmestwa-coder]

I mainly wanted a limit that was large enough to avoid rejecting legitimate larger RTF payloads, while still enforcing a reasonable upper bound for malformed or inconsistent size declarations.

The 50MB value was meant as a conservative default rather than a format-defined maximum. Happy to align it with an existing POI-wide limit pattern, or reduce/remove the configurable default if you’d prefer.

[pjfanning]

don't use return like this - also copyCompressedPayload has its own limit checks, quite untidy to do this

[pjfanning]

https://github.com/apache/commons-io/blob/master/src/main/java/org/apache/commons/io/output/CountingOutputStream.java should be usable - don't really like declaring our own class for this