Unbounded TCP response length can OOM the libfranka client #245

I reproduced a large allocation in libfranka by sending only a 12-byte TCP response header. tcpReadFromBuffer() checks that header.size is at least the header length, then calls pending_response_.resize(header.size) before receiving the payload (source).

In an isolated loopback test at commit e88d08f64cbf842b8f53c0b551963684064038d6, a 64 MiB declared size produced this client measurement:

accepted_declared_size=67108864 maxrss_kb=75444

A second run declared 256 MiB under a 128 MiB container memory limit. The client exited 137, and the container's oom_kill counter rose from 0 to 1. A normal 15-byte Connect response passed. The responder was isolated from the physical robot; the live logs contain no oversized response.

Bound the declared length before allocation. Require the exact size for fixed-size responses and an explicit maximum for variable-size responses, including the robot model. A regression test should send an oversized header without a payload and confirm rejection before allocation.