fix: out-of-bounds write in fsst decompress when data compresses better than 3:1

[LuciferYang]

Problem

fsst::decompress enforces a minimum output buffer of 3 * input, but that bound is unsound. A code can decode to an 8-byte symbol, and decompress_bulk writes a full 8-byte word per code through raw pointers, so the decoded output can be as large as 8 * input. When data compresses better than 3:1, decoding into a buffer sized at the documented minimum runs past the end of the allocation: a segfault under a strict allocator, an out-of-bounds write under Miri/ASan.

In-tree callers happen to allocate 8 * input, so they were never affected. Only the public contract was wrong.

Fix

decompress now grows its (owned) output buffer to 8 * in_buf.len() + 8 before decoding, instead of requiring 3x. The + 8 is one word of headroom for the final speculative write, which lands at out_curr + 8 even when the last symbol is shorter than 8 bytes. The buffer is shrunk back to the exact decoded length afterwards, so callers see no change.

That bound only holds while every symbol is at most 8 bytes. Since the symbol table is read from untrusted on-disk data, init now rejects any table carrying a symbol length above 8 (InvalidData) rather than letting it break the bound.

Tests

• test_decompress_better_than_3x_does_not_overflow and its _64_bit_offsets variant compress highly repetitive input (about 8:1) and decode it into a 3x buffer, checking a correct round trip for both 32- and 64-bit offsets. Both fail before the fix.
• test_decompress_rejects_oversized_symbol_length corrupts a symbol length byte and expects InvalidData.

cargo test -p fsst, cargo clippy -p fsst --tests -- -D warnings, and cargo fmt --all pass.

Closes #7266.

[github-actions]

ACTION NEEDED
Lance follows the Conventional Commits specification for release automation.

The PR title and description are used as the merge commit message. Please update your PR title and description to match the specification.

For details on the error please inspect the "PR Title Check" action.

[codecov]

Codecov Report

❌ Patch coverage is 96.47059% with 3 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
rust/compression/fsst/src/fsst.rs	96.47%	2 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

[LuciferYang]

close this one since #7267 before this one.