Uncontrolled memory allocation in MeshEdgebreakerDecoderImpl::DecodeConnectivity allows DoS with tiny input

Bug

MeshEdgebreakerDecoderImpl::DecodeConnectivity() in mesh_edgebreaker_decoder_impl.cc:380 reads num_faces from untrusted input and passes it directly to vector::reserve() without any upper-bound validation.

A crafted 61-byte Draco file causes attempted allocation of 3.4+ GB, crashing any application that decodes untrusted .drc files.

PoC

Base64: RFJBQ08BAAEBXQEBAAB9AAAzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMAAA==

Impact

Denial of service. Any application using Draco to decode untrusted mesh data (web browsers via WebAssembly, 3D viewers, game engines) can be crashed with minimal input.

Suggested Fix

Cap num_faces and num_points against available buffer size before calling reserve().

Found via fuzzing with AddressSanitizer.