refactor(config,metadata): shared invariants; length-bounded metadata parser

tests/fuzz/fuzz_metadata_from_buf.c

@@ -5,19 +5,19 @@
 #include <string.h>
 
 int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
-  if (size < sizeof(int) + FILE_METADATA_WIRE_SIZE)
-    return 0;
-
-  char* buf = malloc(size);
+  /* Exercise the bounds-checked decoder on EVERY input length, including
+   * records shorter than a full metadata body; the decoder must reject those
+   * without reading past `size`. */
+  char* buf = malloc(size > 0 ? size : 1);
   if (!buf)
     return 0;
-  memcpy(buf, data, size);
+  if (size > 0)
+    memcpy(buf, data, size);
 
-  char* original_buf = buf;
-  FileMetadata* m = metadata_from_buf(&buf);
+  FileMetadata* m = metadata_from_buf((const uint8_t*)buf, size);
   if (m)
     free(m);
 
-  free(original_buf);
+  free(buf);
   return 0;
 }