Fix OOB read in Lz4Immutable::decompress (MACA-2026-001)

Summary:
`memcache/mcrouter-fbpkg` R5519-R5520 fail at the Contbuild Tracking Node: lionhead fuzz harnesses reproduce a confirmed out-of-bounds read in `Lz4Immutable::decompress` (MACA-2026-001, T267172411). A malicious memcache backend sends a Caret reply whose 16-bit match `offset` exceeds the dictionary+output window; the `size_t` subtraction underflows and `IovecCursor::peekInto` reads past the stack-local dictionary iovec. This reproduces the security-certified fix from D104024019 (abandoned only for a CodemodService landing limitation): validate `offset`, `matchPos`, and `matchLength` against the window and return `nullptr` on malformed input, like the existing literal-copy guard.

Sentinel-Harness: claude

Differential Revision: D112676476

fbshipit-source-id: fe74575157de68d5d9be0f1d9d7ae977c1c29af8

Author: generatedunixname26860585020226206

mcrouter/lib/Lz4Immutable.cpp

@@ -539,8 +539,16 @@ std::unique_ptr<folly::IOBuf> Lz4Immutable::decompress(
 
     // Get match offset
     uint16_t offset = peekLE(source);
-    size_t matchPos = dicCursor.totalLength() + (output - outputStart) - offset;
     source.advance(2);
+    size_t outputProgress = static_cast<size_t>(output - outputStart);
+    size_t window = dicCursor.totalLength() + outputProgress;
+    if (FOLLY_UNLIKELY(offset == 0 || offset > window)) {
+      return nullptr;
+    }
+    size_t matchPos = window - offset;
+    if (FOLLY_UNLIKELY(matchPos >= dicCursor.totalLength())) {
+      return nullptr;
+    }
 
     // Get match length
     size_t matchLength = token & kMlMask;
@@ -554,7 +562,9 @@ std::unique_ptr<folly::IOBuf> Lz4Immutable::decompress(
     matchLength += kMinMatch;
 
     // Copy match
-    if (FOLLY_UNLIKELY(output + matchLength > outputLimit)) {
+    if (FOLLY_UNLIKELY(
+            output + matchLength > outputLimit ||
+            matchPos + matchLength > dicCursor.totalLength())) {
       return nullptr;
     }
     match.seek(matchPos);