Optical data transfer receiver, specifically the frame parsing and decoding mechanism.

[POC.zip](github.com/user-attachments/...

## Summary

The receiver trusts the `k`, `blockLen`, and `totalLen` fields of a QR frame header without checking that they are mutually consistent. A **single** crafted frame can declare a `totalLen` of up to `0xFFFFFFFF` (~4.29 GB) that is physically impossible for its block count, drive the fountain decoder to completion, and cause `LTDecoder.assemble()` to attempt `new Uint8Array(totalLen)` — exhausting memory and crashing the receiver tab. No handshake, retransmission, or multi-frame setup is required: showing one hostile QR code to the camera is enough.

## Severity

Medium — availability only. Approximate CVSS:3.1 `AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H` (~4.3). The channel is optical and one-way, so the "attacker" is a display the victim voluntarily points a camera at; there is no confidentiality or integrity impact, and the crash is confined to the receiving tab. It is, however, trivially triggerable and instantaneous.

## Affected component

- `shared/protocol.ts` → `parseFrame()` (validation gap — root cause)
- `receive/main.ts` → `onDecoded()` builds `new LTDecoder(header.k, …, header.totalLen)` straight from the header
- `shared/fountain.ts` → `LTDecoder.assemble()` performs `new Uint8Array(this.totalLen)` (the sink)

## Root cause

`parseFrame` validates only that the size fields are non-zero and that the frame length matches `HEADER_LEN + blockLen`:

```ts
if (header.k === 0 || header.blockLen =...