fix(#76)!: checked size arithmetic in MatterBuilder variable-size parse

[joeldsouzax]

Closes #76.

Problem

MatterBuilder's variable-size parse paths computed the frame size from the attacker-controlled decoded soft size using unchecked arithmetic, violating the arithmetic-safety mandatory rule:

• from_qualified_base64 (:132) and from_qualified_base2 (:263): fs = (size * 4) + cs
• from_qualified_base2 (:265): bfs = (fs * 3).div_ceil(4)

size comes from decode_int(soft). In debug this panics on overflow (DoS on untrusted input, same class as the 5BAA panic fixed in #74); in release it wraps to a small bogus fs, and the subsequent stream.len() < fs check then passes, slicing a truncated frame that parses as valid (silently-wrong parse — exactly what the rule warns about). The adjacent :276 already used .checked_add, so these were inconsistent oversights.

Fix

Extract the three sites into checked helpers in builder.rs:

• compute_full_size(size, cs) → checked_mul(4) + checked_add(cs)
• compute_qb2_byte_size(fs) → checked_mul(3) then div_ceil(4)

Both return a new typed ValidationError::SizeOverflow on overflow (distinct failure domain from IncorrectRawSize). Call sites propagate via ?.

Reachability (resolves the issue's open question)

Latent, not reachable through the parse API today. Variable-size codes cap the soft field at ss=4 (SizeType::Large), so size ≤ 64⁴−1 = 2²⁴−1; then size*4 ≈ 2²⁶ fits even 32-bit usize (wasm32). Reaching overflow needs size ≥ 2³⁰ (a ≥5-char soft field no current code has). Fixed as a Mandatory-Rule violation + defense-in-depth for any future wider soft field.

Because the overflow is unreachable via from_qualified_base64/base2, there is no fuzz-corpus seed to add — the tests probe the checked helpers directly instead.

Tests (TDD)

• RED: 3 overflow tests panicked with "attempt to multiply with overflow" against the bare arithmetic; 2 in-range tests passed.
• GREEN: after checked_*, all 5 pass (SizeOverflow returned), plus 61/61 builder+error tests and the full nix flake check gate.

Breaking change

ValidationError gains a SizeOverflow variant. As the enum is public and not #[non_exhaustive], downstream exhaustive match must handle it — MINOR under the 0.x SemVer convention. Noted in CHANGELOG.

Verification

nix flake check — all checks green (clippy, fmt, taplo, audit, deny, nextest, doctest, wasm, no_std, fuzz-replay).

🤖 Generated with Claude Code

[codspeed-hq]

Merging this PR will not alter performance

✅ 21 untouched benchmarks

---

_{Comparing fix/76-checked-size-arithmetic (7b2bb3e) with main (f0e77b5)}