network: close each bsd fd once and drop unwanted or malformed room packets

Two threads closing the same fd both copied the descriptor and both called
Close(), so a host socket could be closed twice, and the second closesocket
could hit an unrelated socket that had reused the host fd. CloseImpl now
frees the slot under file_descriptors_mutex first and only that thread closes
the socket; the other gets EBADF.

OnProxyPacketReceived decompressed every room packet when any fd had a
socket, including native sockets and proxy sockets on other ports. Sockets
now report through AcceptsProxyPacket whether they want a packet, and only
those are collected, so an unwanted packet is not decompressed.

DecompressDataZSTD passed the frame's declared size straight to the vector
constructor, so a malformed or unsized frame from a room member threw on the
room thread. The new TryDecompressDataZSTD rejects invalid, unsized and
oversized frames, and bsd drops such packets with a warning.
DecompressDataZSTD now returns an empty vector for them instead of throwing.

Assisted-by: Claude Opus 5.5 (investigation and implementation)

1 files changed, 13 insertions, 0 deletions

diff --git a/src/common/zstd_compression.h b/src/common/zstd_compression.h
index 819d7d201a..c20d96adb0 100644
--- a/src/common/zstd_compression.h
+++ b/src/common/zstd_compression.h
@@ -6,6 +6,7 @@
 
 #pragma once
 
+#include <optional>
 #include <span>
 #include <vector>
 
@@ -46,6 +47,18 @@ namespace Common::Compression {
 [[nodiscard]] std::vector<u8> DecompressDataZSTD(std::span<const u8> compressed);
 
 /**
+ * Decompresses a single Zstandard frame that declares its content size.
+ *
+ * @param compressed the compressed source memory region.
+ * @param max_size   the largest content size to accept.
+ *
+ * @return the decompressed data, or nullopt if the frame is invalid, does not declare its size,
+ *         or declares more than max_size bytes.
+ */
+[[nodiscard]] std::optional<std::vector<u8>> TryDecompressDataZSTD(std::span<const u8> compressed,
+                                                                   std::size_t max_size);
+
+/**
  * Decompresses a single Zstandard frame into a caller-provided buffer of known size.
  *
  * @param compressed the compressed source memory region.