some fixes

data_acq_and_processing/common_cpp/ipc/src/shared_types.cpp

@@ -127,12 +127,26 @@ void write_trace_block(BinaryWriter& writer, const SweepTraceBlock& trace) {
     }
 }
 
+// Guard a wire-supplied element count before reserve(): a torn ring slot or buggy
+// producer can present a count near 2^32, and reserve() of that many elements would
+// request gigabytes and crash the process (length_error/bad_alloc/OOM-kill). The
+// payload itself is already bounded by the ring slot size, so any count whose
+// minimum encoding cannot fit in the bytes still available is structurally invalid.
+void require_count_fits(std::uint32_t count, std::size_t min_bytes_each, BinaryReader& reader) {
+    if (min_bytes_each != 0U
+        && static_cast<std::uint64_t>(count) * min_bytes_each > reader.remaining_bytes()) {
+        throw std::runtime_error("Declared element count exceeds remaining payload bytes");
+    }
+}
+
 [[nodiscard]] auto read_trace_block(BinaryReader& reader) -> SweepTraceBlock {
     SweepTraceBlock trace{};
     trace.combo.input_pos = reader.read<std::uint32_t>();
     trace.combo.output_pos = reader.read<std::uint32_t>();
 
     const auto point_count = reader.read<std::uint32_t>();
+    // Each point encodes frequency (4B) + s11 (8B) + s21 (8B) = 20 bytes.
+    require_count_fits(point_count, 20U, reader);
     trace.frequency_hz.reserve(point_count);
     trace.s11.reserve(point_count);
     trace.s21.reserve(point_count);
@@ -183,6 +197,8 @@ void write_trace_collection(BinaryWriter& writer, std::uint32_t magic, const Raw
     collection.monotonic_ns = reader.read<std::uint64_t>();
 
     const auto trace_count = reader.read<std::uint32_t>();
+    // Each trace block is at least 12 bytes (combo 8B + point_count 4B, zero points).
+    require_count_fits(trace_count, 12U, reader);
     collection.traces.reserve(trace_count);
     for (std::uint32_t index = 0; index < trace_count; ++index) {
         collection.traces.push_back(read_trace_block(reader));