Bug: BinaryArchive tree decoding lacks bounded/allocation-free inspection for low-memory and adversarial inputs

[LK-Simon]

Summary

BinaryArchive::Load() builds an owned SerializationNode tree while decoding ESPB v2. On ESP32 this can be unsafe for diagnostic/inspection callers under low-memory conditions because even a structurally valid payload may require additional vector/string allocations. The EventConsole-Lab reproduction exhausted memory while ESPressio Serial reparsed an already-successfully-deserialized Event payload solely for structured diagnostics; std::vector growth entered throwing operator new, and the ESP32 exception/TLS path faulted before a std::bad_alloc catch could recover.

Separately, malformed/adversarial payloads currently need stronger structural limits so deeply nested, excessively broad, or oversized values are rejected before expensive state construction.

Reproduction context

EventConsole-Lab on ESP32, using Event 5.8.0 + Serial 0.5.0 + Serializable 0.10.0, reproduced a LoadProhibited panic while EventMonitorFormatter::PrintStructuredPayload() called BinaryArchive::Load() on an inbound Event Transport transaction. ELF/map decoding identified:

EventMonitor -> BinaryArchive::Load -> BinaryArchive::DecodeNode -> SerializationNode::Set -> std::vector reallocation -> operator new -> __cxa_throw / pthread_getspecific -> LoadProhibited.

The Event had already reached InboundDeserialized, proving that malformed transport bytes are not required to trigger the failure.

Expected behaviour

• Normal BinaryArchive::Load() should reject unreasonable input under explicit/default structural limits.
• Callers that only need validation/inspection must have an allocation-free traversal path that does not construct a second SerializationNode tree.
• Malformed, truncated, deeply nested, excessively broad, or oversized input must fail deterministically and remain bounded.
• The ESPB v2 wire representation must remain compatible.

Required coverage

• bounded recursion / maximum nesting depth;
• bounded aggregate decoded node count;
• bounded object and array collection sizes;
• bounded string/name lengths;
• overflow-safe cursor/bounds checks;
• malformed/truncated payload regression cases;
• adversarial and stress-oriented decode tests;
• allocation-free structural validation/traversal tests;
• preservation of normal valid BinaryArchive compatibility.

Downstream impact

ESPressio Serial EventMonitor should consume the allocation-free traversal API for structured diagnostic rendering in Flowduino/ESPressio-Serial#7.