fix(puffin): reject trailing data in footer payloads

puffin/puffin_reader.go

@@ -224,11 +224,18 @@ func (r *Reader) readFooter() error {
 	}
 
 	payloadReader := io.NewSectionReader(r.r, footerStart+MagicSize, payloadSize)
+	decoder := json.NewDecoder(payloadReader)
 	var footer Footer
-	if err := json.NewDecoder(payloadReader).Decode(&footer); err != nil {
+	if err := decoder.Decode(&footer); err != nil {
 		return fmt.Errorf("puffin: decode footer JSON: %w", err)
 	}
 
+	if _, err := decoder.Token(); err == nil {
+		return errors.New("puffin: footer contains multiple JSON values")
+	} else if !errors.Is(err, io.EOF) {
+		return fmt.Errorf("puffin: trailing data after footer JSON: %w", err)
+	}
+
 	// Validate blob metadata
 	if err := r.validateBlobs(footer.Blobs, footerStart); err != nil {
 		return err

puffin/puffin_test.go

@@ -19,6 +19,7 @@ package puffin_test
 
 import (
 	"bytes"
+	"encoding/binary"
 	"errors"
 	"math"
 	"os"
@@ -149,6 +150,15 @@ func validFileWithBlob() []byte {
 	return buf.Bytes()
 }
 
+func fileWithFooterPayload(payload []byte) []byte {
+	data := append([]byte("PFA1PFA1"), payload...)
+	trailer := make([]byte, 12)
+	binary.LittleEndian.PutUint32(trailer[:4], uint32(len(payload)))
+	copy(trailer[8:], "PFA1")
+
+	return append(data, trailer...)
+}
+
 // --- Tests ---
 
 // TestRoundTrip verifies that data written by Writer can be read back by Reader.
@@ -580,6 +590,33 @@ func TestReaderInvalidFile(t *testing.T) {
 	})
 }
 
+func TestReaderRejectsTrailingFooterData(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name    string
+		payload string
+		wantErr string
+	}{
+		{name: "single object", payload: `{"blobs":[]}`},
+		{name: "trailing whitespace", payload: "{\"blobs\":[]} \n\t"},
+		{name: "second JSON value", payload: `{"blobs":[]}{"blobs":[]}`, wantErr: "multiple JSON values"},
+		{name: "second scalar value", payload: `{"blobs":[]}42`, wantErr: "multiple JSON values"},
+		{name: "trailing garbage", payload: `{"blobs":[]}garbage`, wantErr: "trailing data"},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			_, err := puffin.NewReader(bytes.NewReader(fileWithFooterPayload([]byte(test.payload))))
+			if test.wantErr == "" {
+				require.NoError(t, err)
+			} else {
+				require.ErrorContains(t, err, test.wantErr)
+			}
+		})
+	}
+}
+
 // TestReaderBlobAccess verifies blob access methods work correctly.
 // Tests the primary API for retrieving blob data from puffin files.
 func TestReaderBlobAccess(t *testing.T) {