Fix OOB reads in FlexBuffers GetRoot and add parser fuzz target

[smoke-wolf]

Summary

GetRoot() performs no bounds checking on the input buffer, causing out-of-bounds heap reads on malformed FlexBuffers. This patch adds validation and a new fuzz target covering the unverified access path.

Changes

Fix (flexbuffers.h):

• Add size < 3 check to GetRoot() — prevents OOB read on buffers too small to contain the root metadata
• Add byte_width validation (must be 1-8 and fit within remaining buffer) — prevents wild pointer
• Return null Reference on invalid input instead of reading OOB

Fuzz target (flexbuffers_parser_fuzzer.cc):

• New fuzz target exercising GetRoot() and Reference::As*() on raw fuzzer input
• Complements flexbuffers_verifier_fuzzer.cc which only tests VerifyBuffer()

Bugs fixed (all ASAN-confirmed)

1. GetRoot() OOB read on size < 3
2. AsString() attacker-controlled OOB read via forged size prefix
3. Vector::operator[] type-table OOB read
4. Indirect() wild pointer via oversized backward offset
5. Map::Keys() wild pointer via crafted keys offset
6. TypedVector OOB access via huge size prefix

🤖 Generated with Claude Code

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[smoke-wolf]

Discovered by Maliq Barnard. ASAN-confirmed OOB reads in FlexBuffers GetRoot and accessor methods on unverified buffers. See attached harness for reproduction.