Cap file-declared lengths in agent KV cache reads (memory DoS)

[gigioneggiando]

Summary

agent_kv_read_text() and agent_kv_read_title_trailer() read a uint32 length from a persisted agent session / cache file and immediately xmalloc((size_t)len + 1).

On 64-bit there is no size_t wrap (so no overflow), but the length is uncapped: a 1-byte file declaring text_bytes = 0xFFFFFFFF drives a ~4 GiB allocation before the following fread() fails. An attacker-influenced cache/session file thus becomes a memory-pressure DoS.

Fix

Add agent_fp_remaining() (bytes from the current position to EOF, position-preserving) and reject a length larger than the bytes actually left in the file, before allocating — at both sites.

Verification

Drove the real agent_kv_read_text() with a 1-byte file declaring text_bytes = 0xFFFFFFFF (ASan allocation cap on, so an over-large request is visible instantly):

• before: a ~4 GiB xmalloc request at agent_kv_read_text.
• after: returns false (truncated cached text) with no large allocation.

Found during a coordinated security review of ds4; a standalone offline PoC is available on request. (Companion to the model-loader length-prefix fix — same class, different subsystem.)