[common] Overflow-safe URI length check in VideoFrameDescriptor

[LuciferYang]

Purpose

close #9617

VideoFrameDescriptor.deserialize validated the URI length by adding first:

if (uriLength < 0 || buffer.remaining() < uriLength + 3 * Long.BYTES) {
    throw invalidPayload("invalid URI length: " + uriLength);
}

For a uriLength near Integer.MAX_VALUE the addition wraps negative, the comparison against buffer.remaining() is then false, and control reaches new byte[uriLength]. A crafted descriptor therefore ends in OutOfMemoryError from a 2GB allocation instead of the IllegalArgumentException every other malformed case here produces. The bytes can come from the query: descriptor_to_string and descriptor_to_presigned_url take BINARY arguments.

The sibling BlobDescriptor.deserialize, which dispatches here by magic number, already validates by subtraction and reports each case separately, so this takes the same three checks:

if (uriLength < 0) {
    throw invalidPayload("negative URI length: " + uriLength);
}
if (uriLength > buffer.remaining()) {
    throw invalidPayload("URI length exceeds data size");
}
if (buffer.remaining() - uriLength < 3 * Long.BYTES) {
    throw invalidPayload("missing offset/length/frame index");
}

buffer.remaining() is non-negative and uriLength is known non-negative by the time the subtraction runs, so nothing here can wrap. Three longs rather than the sibling's two, since a video frame descriptor also carries the frame index.

Tests

VideoFrameDescriptorTest.testRejectInvalidPayload gains a case that serializes a valid descriptor and overwrites its URI length field with Integer.MAX_VALUE - 23, the smallest value whose old + 24 wrapped, then asserts the rejection message. Building the payload from serialize() keeps the test off the version and magic byte layout.

Against the unfixed code that case fails with OutOfMemoryError: Java heap space, from the allocation the check was supposed to prevent.

mvn -pl paimon-common -Dtest=VideoFrameDescriptorTest,BlobDescriptorTest test on JDK 8: 12 tests, 0 failures. spotless:check and checkstyle:check on paimon-common are clean.