harden(sip-transport): cap stream body at Content-Length before buffering (#115)

[ryanmurf]

Fixes #115 — TcpTransport::read_from_stream read a peer-declared Content-Length number of bytes into its buffer with no upper bound, allowing unbounded buffer growth (and a latent usize overflow in body_start + content_length). The UDP path is already bounded by the parser MAX_CONTENT_LENGTH; the stream path was not.

Fix

Reject a declared Content-Length above MAX_STREAM_BODY_LENGTH (65536, matching the parser) as soon as the headers are in — before allocating for, or awaiting, the body.

Test + RED control

tcp_rejects_oversized_content_length_without_buffering_body: a peer declares an over-cap body, sends a few bytes, and holds the connection open. With the cap, accept() returns Err(Parse) promptly; without it, the body-read loop blocks forever waiting for the declared length that never arrives. RED run with the cap reverted:

tcp_rejects_oversized_content_length_without_buffering_body ... FAILED
  panicked at transport/mod.rs:591:9
  'accept() must resolve promptly (reject on headers), not block on the body'
  (test timed out after 2s)

With the fix applied: transport tests 35 passed; full cargo test --workspace --exclude pjsip-shim green; cargo clippy --workspace --exclude pjsip-shim -- -D warnings clean. Toolchain 1.97.0.

🤖 Generated with Claude Code