Validate string SerDe bounds before allocation - #783

Problem

The UTF-8 and UTF-16 string SerDes allocate arrays from serialized counts and length prefixes before checking that the input segment contains those bytes. Invalid input can therefore throw NegativeArraySizeException or OutOfMemoryError instead of the expected bounds exception.

Change

Check the minimum prefix space before allocating the output array, and validate each string's payload before allocating its byte buffer. Valid serialized bytes and zero-item behavior are unchanged.

The new tests exercise both SerDes with impossible item counts, negative and oversized length prefixes, truncated prefixes, invalid offsets, and offset Unicode/empty-string round trips. They also verify that decoded strings remain independent of later input mutations.

Verification

Tests-first and full verification on JDK 25:

• Unchanged production: the new tests reproduce the wrong NegativeArraySizeException and OutOfMemoryError paths.
• Fixed source: all 10 focused cases pass.
• mvn -B clean verify: 2,305 tests passed, no failures, errors, or skips.

Source: 628ac813eb143c287ed9da5594e74f5222fc29be. No dependencies or serialization formats changed.

Prepared with OpenAI Codex assistance, including implementation and tests.