fix(cursor): reject overflowing uint32 varints

extensions/ai-providers/cursor/protobuf.ts

@@ -933,6 +933,9 @@ class Reader {
     let shift = 0;
     while (this.pos < this.len) {
       const byte = this.buf[this.pos++];
+      if (shift === 28 && byte > 0x0f) {
+        throw new Error("Varint exceeds 32 bits");
+      }
       result |= (byte & 0x7f) << shift;
       if ((byte & 0x80) === 0) return result >>> 0;
       shift += 7;

tests/extensions/ai-providers/cursor-protobuf.test.ts

@@ -26,3 +26,22 @@ test("protobuf maps do not decode beyond a declared entry boundary", () => {
     /Unexpected EOF reading bytes/,
   );
 });
+
+interface Counter extends ProtoMessage {
+  count: number;
+}
+
+const Counter = pb<Counter>("test.Counter", [
+  { kind: "uint32", no: 1, name: "count" },
+]);
+
+test("uint32 rejects a terminating fifth byte that exceeds 32 bits", () => {
+  assert.equal(
+    Counter.decode(Uint8Array.from([0x08, 0xff, 0xff, 0xff, 0xff, 0x0f])).count,
+    0xffff_ffff,
+  );
+  assert.throws(
+    () => Counter.decode(Uint8Array.from([0x08, 0x80, 0x80, 0x80, 0x80, 0x10])),
+    /Varint exceeds 32 bits/,
+  );
+});