Fix CVE-2024-29025 in v4.1.100.Final

[halimsadab]

This PR backports the security fixes into the v4.1.100.Final branch to remediate the critical CVE-2024-29025 vulnerability. The vulnerability allows attackers to exhaust server memory by submitting unlimited small fields or a growing incomplete field, leading to resource exhaustion, degraded service, or eventual crash (OOM). These risks apply to any application accepting form or multipart HTTP uploads.

Overview of Changes

This PR modifies 4 files:

• HttpPostMultipartRequestDecoder.java: Added input validation for maxBufferedBytes and maxFields parameters to enforce configured upper bounds during multipart form decoding. Introduced exceptions raised when these limits are exceeded to prevent unbounded memory usage. Defaults are applied if limits are not explicitly set, ensuring consistent protection.
• HttpPostRequestDecoder.java: Implemented strict limit checks within the data offer and decode pipelines for maximum allowed form fields and buffered bytes per field. Applied sanitation of input values for these limits to avoid misconfiguration. Enhanced error handling to throw precise exceptions when bounds are breached, ensuring early termination before server resource exhaustion.
• HttpPostStandardRequestDecoder.java: Refined enforcement of maxBufferedBytes and maxFields limits in the decoding process for standard URL-encoded POST content. Added robust checks analogous to the multipart decoder, providing uniform safety across encoding types in Netty’s HTTP POST decoder implementations.
• HttpPostRequestDecoderTest.java: Extended and updated tests to cover the new limit enforcement logic, including cases where max field count and max buffered bytes are exceeded. Validated that the expected exceptions (TooManyFormFieldsException, TooLongFormFieldException) are thrown under attack scenarios. Included default limit configuration tests ensuring fallback protections.

Backporting these changes allows users constrained to 4.1.100.Final to benefit from the critical security safeguards introduced in 4.1.108.Final without requiring a full upgrade path.