fix(reader): sanitize HTTP Content-Range and blob slicing

fetchTail parsed the server-controlled Content-Range header with bare
Long.parseLong and substring calls: a missing '-'/'/' or non-numeric field
threw StringIndexOutOfBoundsException / NumberFormatException instead of a
VortexException. fetchBlob sliced the tail with an unchecked length, throwing
a raw IndexOutOfBoundsException. Parse defensively and slice via IoBounds so
malformed remote responses surface as VortexException.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: dfa1

reader/src/main/java/io/github/dfa1/vortex/reader/VortexHttpReader.java

@@ -159,26 +159,46 @@ private static TailFetch fetchTail(URI uri, HttpClient client) throws IOExceptio
             // Content-Range: bytes <start>-<end>/<total>
             String cr = resp.headers().firstValue("Content-Range")
                             .orElseThrow(() -> new VortexException("206 response missing Content-Range from " + uri));
-            String spec = cr.substring("bytes ".length()); // "<start>-<end>/<total>"
+            return parseContentRange(cr, body, uri);
+        }
+
+        if (status == 200) {
+            // Server returned full file (no Range support)
+            return new TailFetch(body, 0L, body.length);
+        }
+
+        throw new VortexException("HTTP " + status + " fetching tail of " + uri);
+    }
+
+    /// Parses a `bytes <start>-<end>/<total>` Content-Range header from an untrusted server.
+    /// Any structural defect (missing `bytes ` prefix, missing `-`/`/`, non-numeric fields)
+    /// surfaces as a [VortexException] rather than a raw [NumberFormatException] or
+    /// [StringIndexOutOfBoundsException].
+    private static TailFetch parseContentRange(String contentRange, byte[] body, URI uri) {
+        try {
+            String prefix = "bytes ";
+            if (!contentRange.startsWith(prefix)) {
+                throw new VortexException("malformed Content-Range '" + contentRange + "' from " + uri);
+            }
+            String spec = contentRange.substring(prefix.length()); // "<start>-<end>/<total>"
+            int dash = spec.indexOf('-');
             int slash = spec.indexOf('/');
+            if (dash < 0 || slash < 0 || dash > slash) {
+                throw new VortexException("malformed Content-Range '" + contentRange + "' from " + uri);
+            }
+            long start = Long.parseLong(spec.substring(0, dash));
+            long end = Long.parseLong(spec.substring(dash + 1, slash));
             long total = Long.parseLong(spec.substring(slash + 1));
-            long start = Long.parseLong(spec.substring(0, spec.indexOf('-')));
-            long end = Long.parseLong(spec.substring(spec.indexOf('-') + 1, slash));
             long expected = end - start + 1;
             if (body.length != expected) {
                 throw new VortexException(
                     "HTTP tail from %s: Content-Range declares %d bytes but body has %d"
                         .formatted(uri, expected, body.length));
             }
             return new TailFetch(body, start, total);
+        } catch (NumberFormatException e) {
+            throw new VortexException("malformed Content-Range '" + contentRange + "' from " + uri, e);
         }
-
-        if (status == 200) {
-            // Server returned full file (no Range support)
-            return new TailFetch(body, 0L, body.length);
-        }
-
-        throw new VortexException("HTTP " + status + " fetching tail of " + uri);
     }
 
     private static byte[] fetchRange(URI uri, long from, long to, HttpClient client) throws IOException {
@@ -215,8 +235,8 @@ private static MemorySegment fetchBlob(
         URI uri, HttpClient client
     ) throws IOException {
         if (offset >= tailStart) {
-            int relOffset = (int) (offset - tailStart);
-            return MemorySegment.ofArray(tail).asSlice(relOffset, length);
+            long relOffset = offset - tailStart;
+            return IoBounds.slice(MemorySegment.ofArray(tail), relOffset, length);
         }
         byte[] bytes = fetchRange(uri, offset, offset + length - 1, client);
         return MemorySegment.ofArray(bytes);