bug: Simple8b 240x zero-run amplification on top of unbounded pre-reserve

[minagishl]

Bug Description

Simple8b supports a 240× zero-run selector. The decoder reads a declared output length and pre-reserves a Vec of that size at src/codec.rs:372 and :381, then emits up to 240 zeros per packed 64-bit word. Combined with #1 (unbounded length pre-reserve), the attacker controls both the upfront allocation and the per-word expansion factor, giving 240× amplification on top of the underlying OOM primitive.

Steps to Reproduce

1. Construct a typed-vector payload with codec=Simple8b, len = 0x0FFF_FFFF, and packed zero-run selectors.
2. Decode.
3. Decoder allocates len * 8 bytes (~2 GB for len = 2^28) and proceeds to fill it with zeros.

Expected Behavior

len must be sanity-checked against reader.remaining() * 240 before any allocation, and the running output count must be checked against len after every selector is decoded.

Actual Behavior

Pre-reserve allocates the full declared output size; the 240× selector amplifies tiny inputs.

Environment

• Crate: recurram, Simple8b codec in src/codec.rs:372,381

Additional Context

Severity: High — amplifier on top of #1.