[deadp]

This branches from #13. Only the last commit (Bound every size-driven read when opening EWF images) is new. Once #13 merges, this diff shrinks to that commit alone.

Problem

EwfImage used sizes and offsets from the segment file directly as read lengths and seek offsets:

• the section descriptor's size (volume, header, hash and digest sections)
• the table's base offset and entry count
• the section next pointer
• sectors_per_chunk × bytes_per_sector, which also sizes the zero-fill for a chunk that won't decompress

One damaged or hostile descriptor could therefore make Strata try to read gigabytes into memory. In other cases it raised OverflowError or OSError from seek, instead of recording a finding. tests/fuzz.py hit all of these within 3 minutes (ewf.py:178, 195, 211, 291, 305, 306, 317).

Fix

• One bounded read path. Everything now reads through _read_bounded, which stops at the end of the segment and at a per-structure cap: metadata sections 1 MB, header sections 16 MB, table entries 2^20, chunks at the chunk size plus zlib's worst-case expansion.
• Clips become findings. A section or chunk that declares more than can be read is recorded, not silently truncated. A chunk that merely runs into the end of the file is not flagged, since a final chunk sized from the nominal length does that legitimately.
• Implausible geometry falls back to defaults. Bytes per sector outside 512–4096, or chunks over 64 MB, fall back to the defaults, with a finding.
• A failed open closes its segment handles. Previously they leaked, which on Windows keeps the evidence file locked.

Readable images behave as before: the existing EWF tests pass unchanged, including the ones asserting no findings on clean images.

Tests

• New HostileSizes class in tests/test_ewf.py with 8 tests. All 8 fail or error on the previous ewf.py and pass with this change.
• Every EWF input the CI fuzz run saved (11 distinct) now opens, or fails with a clean EwfError.
• Full suite: 297 tests, OK (17 expected failures, all unrelated to this change). Both files parse as Python 3.8.

🤖 Generated with Claude Code