fix: bake CI deps into Docker image, fix chunk use_metadata OOB

- Build and push fastsync-ci:v8 with lcov, valgrind, clang baked in
- Remove all apt-get install steps from CI (v8 has them pre-installed)
- Fix chunk.c use_metadata=true OOB: add remaining_size guard before
  metadata_from_buf reads past the buffer. The bug allowed network-facing
  chunk_deserialize to heap-buffer-overflow on crafted inputs.
- Also guard against unsigned underflow on remaining_size - sizeof(int)

.gitea/workflows/ci.yaml

@@ -5,7 +5,7 @@ on: [push, pull_request]
 jobs:
   lint:
     runs-on: ubuntu-latest
-    container: gitea.tap-tap.win/taptap/fastsync-ci:v7
+    container: gitea.tap-tap.win/taptap/fastsync-ci:v8
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -18,7 +18,7 @@ jobs:
 
   build-and-test:
     runs-on: ubuntu-latest
-    container: gitea.tap-tap.win/taptap/fastsync-ci:v7
+    container: gitea.tap-tap.win/taptap/fastsync-ci:v8
     needs: lint
     steps:
       - name: Checkout
@@ -38,7 +38,7 @@ jobs:
 
   sanitizers:
     runs-on: ubuntu-latest
-    container: gitea.tap-tap.win/taptap/fastsync-ci:v7
+    container: gitea.tap-tap.win/taptap/fastsync-ci:v8
     needs: lint
     strategy:
       matrix:
@@ -58,15 +58,12 @@ jobs:
 
   fuzz-build:
     runs-on: ubuntu-latest
-    container: gitea.tap-tap.win/taptap/fastsync-ci:v7
+    container: gitea.tap-tap.win/taptap/fastsync-ci:v8
     needs: lint
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Install clang
-        run: apt-get update -qq && apt-get install -y -qq clang
-
       - name: Configure (clang + fuzz)
         run: CC=clang CXX=clang++ cmake -B build-fuzz -S . -DENABLE_FUZZ=ON
 
@@ -75,15 +72,12 @@ jobs:
 
   coverage:
     runs-on: ubuntu-latest
-    container: gitea.tap-tap.win/taptap/fastsync-ci:v7
+    container: gitea.tap-tap.win/taptap/fastsync-ci:v8
     needs: lint
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Install lcov
-        run: apt-get update -qq && apt-get install -y -qq lcov
-
       - name: Configure
         run: cmake -B build -S . -DENABLE_COVERAGE=ON -DSTRICT_WARNINGS=ON
 
@@ -101,15 +95,12 @@ jobs:
 
   valgrind:
     runs-on: ubuntu-latest
-    container: gitea.tap-tap.win/taptap/fastsync-ci:v7
+    container: gitea.tap-tap.win/taptap/fastsync-ci:v8
     needs: lint
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Install valgrind
-        run: apt-get update -qq && apt-get install -y -qq valgrind
-
       - name: Configure
         run: cmake -B build -S . -DSTRICT_WARNINGS=ON
 

Dockerfile

@@ -1,7 +1,8 @@
 FROM ubuntu:24.04
 RUN apt-get update && apt-get install -y --no-install-recommends \
     gcc g++ make libc6-dev cmake libzstd-dev libssl-dev git ca-certificates curl cppcheck clang-format \
-    python3 python3-pip python3-venv openssl openssh-client lcov valgrind && \
+    python3 python3-pip python3-venv openssl openssh-client \
+    lcov valgrind clang libclang-rt-18-dev && \
     pip3 install --break-system-packages pytest && \
     curl -fsSL https://deb.nodesource.com/setup_20.x | bash - && \
     apt-get install -y --no-install-recommends nodejs && \

src/shared/chunk.c

@@ -120,10 +120,23 @@ Chunk* chunk_deserialize(Data* data, bool use_metadata) {
     free(path);
 
     if (use_metadata) {
+      if (remaining_size < sizeof(int)) {
+        log_message(LOG_LEVEL_ERROR, "Invalid chunk format: not enough data for metadata");
+        array_list_delete(files);
+        return NULL;
+      }
       file->metadata = metadata_from_buf(&data_pointer);
       remaining_size -= sizeof(int);
-      if (file->metadata)
+      if (file->metadata) {
+        if (remaining_size < FILE_METADATA_WIRE_SIZE) {
+          log_message(LOG_LEVEL_ERROR, "Invalid chunk format: not enough data for metadata body");
+          free(file->metadata);
+          file->metadata = NULL;
+          array_list_delete(files);
+          return NULL;
+        }
         remaining_size -= FILE_METADATA_WIRE_SIZE;
+      }
     }
 
     if (remaining_size < sizeof(size_t)) {