Protobuf Boundary Safety — wire crate

[maxholman]

Protobuf Boundary Safety — wire crate

Scope

crates/wire/src/helpers.rs, crates/wire/src/data.rs,
crates/wire/src/socket_set.rs

Out of scope

Behaviour changes beyond error propagation. No changes to callsites outside
crates/wire/.

Why

Two silent data-corruption paths at the protobuf deserialisation boundary:

1. vec_to_sized_array silently truncates or zero-pads if the input length
   doesn't match N. A 17-byte "IPv4 address" from a malformed protobuf
   message produces a wrong IP address with no error.

2. port as u16 silently truncates a protobuf u32 port field. A port value
   above 65535 wraps to a wrong port with no error.

Both are suppressed today with #[allow(clippy::cast_possible_truncation)].

What

1. vec_to_sized_array — return Result

Add InvalidLength { expected: usize, got: usize } to ConversionError in
helpers.rs.

Change signature:

pub fn vec_to_sized_array<const N: usize>(vec: &[u8]) -> Result<[u8; N], ConversionError>

Reject any input where vec.len() != N.

The call sites in data.rs are currently infallible From impls — change
them to TryFrom:

• From<IpV4Address> for std::net::Ipv4Addr → TryFrom
• From<IpV6Address> for std::net::Ipv6Addr → TryFrom
• From<ip_address::IpAddress> for std::net::IpAddr → TryFrom

Update any downstream callers that used .into() on these types to use ?.

2. Port truncation — u16::try_from

Add InvalidPort variant to ConversionError.

In socket_set.rs and data.rs, replace every port as u16 with:

u16::try_from(src.port).map_err(|_| ConversionError::InvalidPort)?

Remove:

• #![allow(clippy::cast_possible_truncation)] at top of socket_set.rs
• Inline #[allow(clippy::cast_possible_truncation)] at data.rs:167,178

3. Tests

Add #[cfg(test)] tests in helpers.rs:

• vec_to_sized_array::<4> with a 5-byte input → Err(InvalidLength)
• vec_to_sized_array::<4> with a 4-byte input → Ok

Add test in socket_set.rs or data.rs:

• Port value 70_000u32 in a TryFrom impl → Err(InvalidPort)

Notes

• The task doc references crates/protobuf/ — the crate was renamed to
  crates/wire/. All files are in crates/wire/.
• just check must pass after the change.