Bound ULEB128-derived allocation sizes in RenderingConfig and ElementGainOffsetConfig

[jortles]

Summary

• Add bounds checks against kEntireObuSizeMaxTwoMegabytes before ULEB128-sized vector allocations in RenderingConfig::CreateFromBuffer() and ElementGainOffsetConfig::CreateFromBuffer()
• Prevents OOM process crash from crafted IAMF bitstreams with large extension size values
• Follows the existing bounds-checking pattern used in extended_param_definition.cc and param_definition_base.cc

Problem

rendering_config_extension_size and element_gain_offset_size are read as ULEB128 values from the bitstream and passed directly to std::vector constructors with no upper bound. A 5-byte ULEB128 encoding can request up to ~4 GB, causing std::bad_alloc → std::terminate → process crash.

Affected sites:

File	Line	Variable
rendering_config.cc	298	rendering_config_extension_size → vector<uint8_t>(N)
element_gain_offset_config.cc	158	element_gain_offset_size → vector<uint8_t>(N)

Fix

Check against the existing kEntireObuSizeMaxTwoMegabytes (2 MB) constant before allocating, returning InvalidArgumentError for oversized values. This is the same pattern used at:

• extended_param_definition.cc:46
• param_definition_base.cc:147

Test plan

• Existing unit tests pass (bazelisk test //iamf/obu/...)
• Verified crafted IAMF bitstream with rendering_config_extension_size = 0x3FFFFFFF now returns error instead of OOM crash
• Verified crafted IAMF bitstream with large element_gain_offset_size now returns error instead of OOM crash

[Copilot]

Pull request overview

This PR hardens IAMF OBU parsing against malicious or malformed bitstreams by bounding ULEB128-derived size fields before allocating extension byte vectors, preventing potential OOM-triggered crashes.

Changes:

• Add a kEntireObuSizeMaxTwoMegabytes upper-bound check for rendering_config_extension_size in RenderingConfig::CreateFromBuffer().
• Add the same upper-bound check for element_gain_offset_size in ElementGainOffsetConfig::CreateFromBuffer().
• Update Bazel deps to include :types where the new constant is referenced.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
iamf/obu/rendering_config.cc	Adds a max-size guard before allocating/reading rendering config extension bytes.
iamf/obu/element_gain_offset_config.cc	Adds a max-size guard before allocating/reading element gain offset extension bytes; includes needed headers.
iamf/obu/BUILD	Adds :types dependency for element_gain_offset_config to support the new constant reference.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.