Bound decoder work to prevent a pointer fan-out DoS (STF-1572)

CLAUDE.md

@@ -35,14 +35,14 @@ dotnet build MaxMind.Db.sln
 
 ```bash
 # Run all tests
-dotnet test MaxMind.Db.Test/MaxMind.Db.Test.csproj
+dotnet test --project MaxMind.Db.Test/MaxMind.Db.Test.csproj
 
 # Run specific test class
-dotnet test --filter "FullyQualifiedName~ReaderTest"
-dotnet test --filter "FullyQualifiedName~DecoderTest"
+dotnet test --project MaxMind.Db.Test/MaxMind.Db.Test.csproj -- --filter-class "*ReaderTest"
+dotnet test --project MaxMind.Db.Test/MaxMind.Db.Test.csproj -- --filter-class "*DecoderTest"
 
 # Run specific test method
-dotnet test --filter "FullyQualifiedName~ReaderTest.TestMany"
+dotnet test --project MaxMind.Db.Test/MaxMind.Db.Test.csproj -- --filter-method "*ReaderTest.TestPointerHeavyValueCountDecodes"
 ```
 
 ### Running Benchmarks

MaxMind.Db.Benchmark/Program.cs

@@ -7,7 +7,7 @@
 using System.Linq;
 using System.Net;
 
-BenchmarkRunner.Run<CityBenchmark>();
+BenchmarkRunner.Run<CityBenchmark>(args: args);
 
 [MemoryDiagnoser]
 public class CityBenchmark

MaxMind.Db.Test/CollectionActivatorTest.cs

@@ -0,0 +1,68 @@
+using System.Collections.Generic;
+using Xunit;
+
+namespace MaxMind.Db.Test
+{
+    public static class CollectionActivatorTest
+    {
+        [Fact]
+        public static void ListFactoryUsesRequestedCapacity()
+        {
+            var factory = new ListActivatorCreator().GetActivator(typeof(ICollection<long>));
+            var list = Assert.IsType<List<long>>(factory(123));
+            Assert.Empty(list);
+            Assert.Equal(123, list.Capacity);
+        }
+
+        [Fact]
+        public static void ListFactoryPreservesCustomDefaultConstructor()
+        {
+            var factory = new ListActivatorCreator().GetActivator(typeof(DefaultList<long>));
+            var list = Assert.IsType<DefaultList<long>>(factory(123));
+            Assert.True(list.WasConstructed);
+            Assert.Equal(0, list.Capacity);
+        }
+
+        [Fact]
+        public static void DictionaryFactoryCreatesRequestedInterface()
+        {
+            var factory = new DictionaryActivatorCreator().GetActivator(typeof(IDictionary<string, long>));
+            var dictionary = Assert.IsType<Dictionary<string, long>>(factory(123));
+            Assert.Empty(dictionary);
+#if NET8_0_OR_GREATER
+            Assert.True(dictionary.EnsureCapacity(0) >= 123);
+#endif
+            dictionary.Add("value", 7);
+            Assert.Equal(7, dictionary["value"]);
+        }
+
+        [Fact]
+        public static void DictionaryFactoryPreservesCustomDefaultConstructor()
+        {
+            var factory = new DictionaryActivatorCreator().GetActivator(typeof(DefaultDictionary<string, long>));
+            var dictionary = Assert.IsType<DefaultDictionary<string, long>>(factory(123));
+            Assert.True(dictionary.WasConstructed);
+            Assert.Empty(dictionary);
+        }
+
+        private sealed class DefaultList<T> : List<T>
+        {
+            public DefaultList()
+            {
+                WasConstructed = true;
+            }
+
+            public bool WasConstructed { get; }
+        }
+
+        private sealed class DefaultDictionary<TKey, TValue> : Dictionary<TKey, TValue> where TKey : notnull
+        {
+            public DefaultDictionary()
+            {
+                WasConstructed = true;
+            }
+
+            public bool WasConstructed { get; }
+        }
+    }
+}