fix(candid): bound length-prefixed allocations in header parser + release candid 0.10.35

[lwshang]

Patch release. Bounds allocation for length-prefixed fields in the type-table header parser. See CHANGELOG.

🤖 Generated with Claude Code

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to f28574a.

Security Overview

• 🔎 Scanned files: 7 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/7ddf29dd-76dc-4f78-adfa-47ac8f4643e7?scanId=800a209b-c93b-4676-b271-f82bfcff4b60&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► rust/candid/src/binary_parser.rs     Implement bounded, chunked read_len_prefixed to avoid oversized allocations ► rust/candid/src/binary_parser.rs     Replace large count-based blob reads with bounded reads ► rust/candid/tests/type_table_alloc.rs     Add tests for type-table header allocation safety
Bug Fix	► rust/candid/src/binary_parser.rs     Handle short input and out-of-range lengths for length-prefixed blobs
Documentation/Changelog Update	► CHANGELOG.md     Bump changelog entries for version 0.10.35 and related changes
Development/Build Configuration	► rust/candid/Cargo.toml     Update candid_derive dependency version to 0.10.35
Development/Build Configuration	► rust/candid_derive/Cargo.toml     Update version to 0.10.35

[marc0olo]

Review content removed. Follow-up offline.

Dismissed; re-reviewing offline.

[marc0olo]

Re-reviewed at f28574a. LGTM.

Checked the parser change against the binrw 0.15.2 internals it relies on, and confirmed the other length-prefixed read sites in binary_parser.rs behave correctly and need no equivalent change. The chunk size lines up with what Take::read_to_end reserves internally, so buffer growth stays linear. Loop termination and the short-read condition are correct.

Release hygiene is consistent: candid and candid_derive both to 0.10.35, the =0.10.35 pin matches, both Cargo.locks updated, and candid_parser's caret dependency correctly needs no bump. cargo test -p candid is green locally, and the new tests fail without the parser change.

The follow-up commit is CHANGELOG-only with no code delta, and the reworded compatibility note reads accurately now.

Non-blocking, pre-existing, worth a separate issue: the remaining #[br(count = len)] sites narrow a u64 wire length to usize. This PR keeps u64 end-to-end in the two fields it touches; the rest could be tidied up later.