fix(puffin): return DataInvalid instead of panicking on malformed footer length

[arpitjain099]

What changes are included in this PR?

FileMetadata::read locates the footer by subtracting from the file size, but never checks the file is big enough first. Two subtractions can underflow:

• read_footer_payload_length does input_file_length - FOOTER_STRUCT_LENGTH, so any file shorter than 12 bytes underflows.
• read_footer_bytes does input_file_length - footer_length, where footer_length is derived from footer_payload_length, the u32 read out of the FooterPayloadSize field of the file being parsed. A file that declares a payload larger than itself underflows here.

In debug builds both panic with "attempt to subtract with overflow". In release the subtraction wraps and you get a bogus read range instead.

Worth saying up front: I'm treating this as robustness, not a security issue. Puffin files are table statistics written by the engines that already write the table, so I'm not claiming a meaningful trust boundary. The point is narrower - a truncated or corrupt file should surface as a DataInvalid error, the way the magic checks and the bounds checks in decode_flags / extract_footer_payload_as_str already do in this same file, rather than panicking on the caller.

The fix adds a MIN_FILE_LENGTH check in read and switches the second subtraction to checked_sub, both returning ErrorKind::DataInvalid.

I left read_with_prefetch alone. Its prefetch_hint > 16 and prefetch_hint <= input_file_length guards already keep its own slicing in range, and when the declared footer is larger than the hint it falls back to read, which is now checked.

Are these changes tested?

Two unit tests, one per case. Both panic before the fix:

thread 'puffin::metadata::tests::test_file_shorter_than_minimum_length_returns_error'
panicked at crates/iceberg/src/puffin/metadata.rs:201:21:
attempt to subtract with overflow

thread 'puffin::metadata::tests::test_footer_payload_length_larger_than_file_returns_error'
panicked at crates/iceberg/src/puffin/metadata.rs:218:21:
attempt to subtract with overflow

After the fix, cargo test -p iceberg --lib puffin gives 39 passed, 0 failed. Full crate cargo test -p iceberg --lib is 1444 passed, 0 failed, and cargo clippy -p iceberg --all-targets is clean.

[viirya]

Reproduced both failure modes by reverting the guards locally with the new tests kept: test_file_shorter_than_minimum_length_returns_error and test_footer_payload_length_larger_than_file_returns_error both die with attempt to subtract with overflow at exactly the two subtractions described, and pass with the guards in place. All 39 puffin tests pass on current main with the change applied.

The MIN_FILE_LENGTH arithmetic checks out against the Puffin layout: header magic (4) + footer magic (4) + empty payload (0) + payload-size (4) + flags (4) + trailing magic (4) = 20 = MAGIC_LENGTH * 2 + FOOTER_STRUCT_LENGTH. And the framing is right — this is robustness, matching the existing DataInvalid style of the magic/flags checks in the same file, not a security claim. Leaving read_with_prefetch alone is correct too, since its own guards keep its slicing in range and the fallback lands in the now-checked read.

One tiny behavioral note, fine as-is: the length check now runs before the magic check, so a short file with garbage magic reports "too short" rather than "bad magic" — arguably the more informative of the two errors anyway. LGTM.