…ngth-prefixed values and collections

A bytes or string value is a length prefix followed by that many bytes, and an
array or map block is an element count followed by that many items. A malicious
or truncated input can declare a huge length or count with little or no data.

- BinaryDecoder.RemainingBytes() reports the bytes still readable for a seekable
  stream (or -1). ReadBytes and both ReadString implementations reject an
  over-large declared length before allocating.
- DefaultReader.ReadArray/ReadMap reject a block whose element count could not be
  backed by the bytes remaining, using MinBytesPerElement() computed from the
  element schema so a zero-byte element type (e.g. null) is not falsely rejected.
  The count is checked on the raw long before the int cast, which also avoids
  the cast overflowing into a bogus pre-allocation.

Mirrors the Java SDK's checks (AVRO-4241). Non-seekable streams and non-binary
decoders are unaffected.

Assisted-by: GitHub Copilot:claude-opus-4.8

…harden min-bytes sum

Review feedback:
- read(long) now rejects a negative length explicitly instead of letting it flow
  into a negative array allocation.
- EnsureCollectionAvailable rejects a block count above int.MaxValue before the
  callers cast it to int, independently of the per-element size (so it also
  covers null-element arrays where the byte check is skipped).
- MinBytesPerElement accumulates record field minima in a long and clamps to
  int.MaxValue, so deep nesting cannot overflow int into a value <= 0 that would
  disable the check; the depth guard now returns 1 (not 0) for the same reason.
- The NonSeekableStream test helper disposes its wrapped inner stream.

Assisted-by: GitHub Copilot:claude-opus-4.8

…erflow

Review feedback: the map's minBytes was computed as 1 + MinBytesPerElement(...).
Since MinBytesPerElement clamps to int.MaxValue, adding 1 in int arithmetic
overflows to a negative value, which makes minBytesPerElement <= 0 and silently
disables the remaining-bytes validation for maps. Compute both the array and map
minima as long (1L + ...) and take a long in EnsureCollectionAvailable.

Assisted-by: GitHub Copilot:claude-opus-4.8

Review feedback: ReadBytes() -> read(long) allocates new byte[p]. A seekable
stream can declare (and hold) more than the maximum .NET array length, so
new byte[p] would throw an OverflowException/OutOfMemoryException instead of a
consistent AvroException. Reject a length above MaxDotNetArrayLength first, as
ReadString() already does. Added a test using a non-seekable stream.

Assisted-by: GitHub Copilot:claude-opus-4.8

…p null returns 0

Review feedback:
- RemainingBytes() clamps a negative result (Position past Length on a truncated
  or externally seeked stream) to 0, so callers only ever see -1 (unknown) or a
  non-negative count and the check is not skipped.
- EnsureCollectionAvailable rejects a negative block count explicitly (it can
  arise from long.MinValue overflow when negating a negative count) instead of
  returning early and letting the caller cast it to int.
- MinBytesPerElement applies the depth guard only in the record case, so a
  zero-byte leaf type (null) nested under deep records still returns 0.

Assisted-by: GitHub Copilot:claude-opus-4.8

Completes the available-bytes protection for collections. Elements whose schema
encodes to zero bytes (null, a zero-length fixed, or a record with only
zero-byte fields) consume no input, so the bytes-remaining check cannot bound
their count. A tiny payload declaring a huge array block count of such elements
(e.g. {"type":"array","items":"null"} with a count of 200,000,000) therefore
drove an unbounded ResizeArray and exhausted memory.

EnsureCollectionAvailable now tracks the cumulative count across blocks and
enforces, per block: a structural cap on all collections
(MaxCollectionStructural = Integer.MAX_VALUE - 8, also covering non-seekable
decoders and keeping the total within the int range the callers cast to); a
zero-byte item cap (MaxCollectionItems = 10,000,000) when the per-element
minimum is zero; and the existing bytes-remaining check otherwise.
AVRO_MAX_COLLECTION_ITEMS, when set, caps both. The reader array/map loops and
the schema-resolution Skip path for arrays and maps are all bounded the same
way, so skipping a huge zero-byte block cannot loop unboundedly.

Assisted-by: GitHub Copilot:claude-opus-4.8

A negative block count is normalized by negating it (result = -result), but
long.MinValue cannot be negated: under unchecked arithmetic it wraps back to a
negative value, and under checked arithmetic it throws OverflowException. The
zig-zag encoding of long.MinValue is a valid 10-byte varint, so this is
reachable from malformed input.

Reject long.MinValue explicitly in doReadItemCount() with a clear AvroException,
consistent with the C and C++ bindings. Adds tests for a long.MinValue block
count on ReadArrayStart() and ReadMapStart().

Assisted-by: GitHub Copilot:claude-opus-4.8

…_ITEMS

The collection-limit tests assume the default caps, but AVRO_MAX_COLLECTION_ITEMS
overrides them, so a value set in a shell/CI could make them flaky (fail, or
reject a legitimate array). Add [SetUp]/[TearDown] that clear the env var for
each test and restore it afterward, so they run deterministically against the
defaults.

Assisted-by: GitHub Copilot:claude-opus-4.8

GenericReader captures AVRO_MAX_COLLECTION_ITEMS into static readonly fields at
class load, so clearing the env var at runtime in [SetUp] had no effect on the
already-computed limits. Remove the misleading [SetUp]/[TearDown] and document
that the collection-limit tests assume the process was not started with a custom
AVRO_MAX_COLLECTION_ITEMS.

Assisted-by: GitHub Copilot:claude-opus-4.8

…em cap

The array<null> decode and skip tests declared 200,000,000 elements. Since a
zero-byte element consumes no input, a future regression of the item-cap guard
could let those loops run toward that count and hang/OOM the test process.
Use 10,000,001 (just over the default 10,000,000 zero-byte item cap) so the
rejection path is still exercised but the failure mode stays bounded.

Assisted-by: GitHub Copilot:claude-opus-4.8