A packfile object header carries the object's uncompressed size, and
a well-formed packfile never produces more inflated bytes than that
value. Enforce this structural invariant at every site that consumes
the inflated stream and surface mismatches as
`ErrInflatedSizeMismatch`.

Both `Scanner.NextObject` and `Scanner.ReadObject` capture the
declared length from the most recent `pendingObject` before clearing
it, then thread that bound into `copyObject`. The shared
`copyObject(w, declaredSize)` wraps its writer in a new
`boundedWriter` when a positive size is supplied, so an overrun
returns the legal prefix alongside `ErrInflatedSizeMismatch` rather
than being silently appended. Callers in `parser.go` and
`packfile.go` go through `NextObject`, so they pick up the bound
without further changes; for delta entries the declared length is
the size of the delta instruction stream, not the resolved result,
which matches what these call sites already pass through.

The lazy `FSObject.Reader` big-object path returns a new
`boundedReadCloser` that wraps the underlying zlib-backed reader.
It builds on `io.LimitedReader` with the standard overrun-detection
trick — request `limit + 1` bytes and treat the sentinel byte as an
explicit signal — so an `io.ReadAll` on an opened object cannot
stream past the declared size. The bound is `o.size`, the resolved
object size, which matches what the caller is reading regardless of
whether the underlying entry is a non-delta or delta-resolved
object. The type and its constructor are unexported for now; they
can be promoted once a stable use case outside the package emerges.

These changes do not reject any conforming pack.

Backport of go-git#2119.

Assisted-by: Claude Opus 4.7
Signed-off-by: Hidde Beydals <[email protected]>

`Reader` defines a two-phase contract: callers must invoke `Header`
to consume the loose-object type and size fields, after which the
internal `multi` reader and `hasher` are initialised. Calling `Read`
or `Hash` before a successful `Header` accessed uninitialised
fields and would panic on `r.multi.Read` / `r.hasher.Sum`.

Make the contract explicit: `Read` returns the new `ErrHeaderNotRead`
sentinel when `Header` has not been called successfully. `Hash`
returns `plumbing.ZeroHash` in the same situation. Both methods
guard on `r.multi == nil`, which `prepareForRead` sets on the first
successful `Header` call.

Two unit tests pin the behaviour: `TestReaderReadBeforeHeader`
asserts that `Read` returns `ErrHeaderNotRead` and `Hash` returns
`ZeroHash`; `TestReaderReadAfterHeaderError` calls `Read` after
`Header` has returned an error.

Backport of go-git#2119.

Assisted-by: Claude Opus 4.7
Signed-off-by: Hidde Beydals <[email protected]>

Apply the size formula canonical Git uses in `packfile.c:load_idx`
[1]: for an idx v2 file with `nr` objects and hash size `hashsz`,
the on-disk length must lie within `[minSize, maxSize]` where

    minSize = 8 + 4*256 + nr*(hashsz+8) + 2*hashsz
    maxSize = minSize + (nr-1)*8     when nr > 0

Overflow-checked multiplication rejects inputs whose claimed object
count overflows the formula rather than wrapping into a smaller
value.

To keep the public `NewDecoder(io.Reader)` signature compatible on
v5, the decoder probes for an unexported `statInput` interface
(`Stat() (fs.FileInfo, error)`) at the top of `Decode`. Inputs that
satisfy it have the size formula applied; arbitrary readers retain
the pre-existing behaviour of erroring out at the truncated-payload
boundary. The two production call sites in `storage/filesystem`
pass a `billy.File`; on `osfs` that wraps `*os.File`, so the
formula does run there.

[1]: https://github.com/git/git/blob/v2.54.0/packfile.c#L232-L258

Backport of #2119.

Assisted-by: Claude Opus 4.7
Signed-off-by: Hidde Beydals <[email protected]>