fix: bound aggregate FSSHTTP references

src/onenote/fsshttpb/primitives.ts

@@ -19,6 +19,11 @@ import type {
   FssHttpStreamHeader,
 } from './types.js';
 
+export interface FssHttpReferenceBudget {
+  readonly limit: number;
+  used: number;
+}
+
 export function readCompactU64(reader: BinaryReader): bigint {
   const offset = reader.offset;
   const first = reader.u8();
@@ -92,13 +97,16 @@ export function readFssHttpExGuid(reader: BinaryReader): ExGuid {
 
 export function readFssHttpExGuidArray(
   reader: BinaryReader,
-  limits: OneNoteParserLimits
+  limits: OneNoteParserLimits,
+  budget: FssHttpReferenceBudget
 ): ExGuid[] {
+  const countOffset = reader.offset;
   const count = readCompactNumber(
     reader,
     limits.maxObjectReferences,
     'Extended GUID array count'
   );
+  reserveReferenceBudget(budget, count, countOffset);
   const result: ExGuid[] = [];
   for (let index = 0; index < count; index += 1) {
     result.push(readFssHttpExGuid(reader));
@@ -115,13 +123,16 @@ export function readFssHttpCellId(reader: BinaryReader): FssHttpCellId {
 
 export function readFssHttpCellIdArray(
   reader: BinaryReader,
-  limits: OneNoteParserLimits
+  limits: OneNoteParserLimits,
+  budget: FssHttpReferenceBudget
 ): FssHttpCellId[] {
+  const countOffset = reader.offset;
   const count = readCompactNumber(
     reader,
     limits.maxObjectReferences,
     'Cell ID array count'
   );
+  reserveReferenceBudget(budget, count, countOffset);
   const result: FssHttpCellId[] = [];
   for (let index = 0; index < count; index += 1) {
     result.push(readFssHttpCellId(reader));
@@ -129,6 +140,21 @@ export function readFssHttpCellIdArray(
   return result;
 }
 
+function reserveReferenceBudget(
+  budget: FssHttpReferenceBudget,
+  count: number,
+  offset: number
+): void {
+  if (count > budget.limit - budget.used) {
+    throw new OneNoteParserError(
+      'LIMIT_EXCEEDED',
+      `FSSHTTPB object and cell reference count exceeds ${budget.limit}`,
+      { offset, structure: 'FSSHTTPB object and cell references' }
+    );
+  }
+  budget.used += count;
+}
+
 export function readFssHttpSerialNumber(
   reader: BinaryReader
 ): FssHttpSerialNumber {