Function decode_one_with_limit

pub fn decode_one_with_limit(
    buf: &mut Vec<u8>,
    max_frame_size: usize,
) -> Result<Option<Frame>, CodecError>

Pulls one complete frame from buf.

Incomplete data returns Ok(None) and leaves buf intact aside from leading heartbeat bytes (\n / \r / NUL). A complete frame is drained from the front so two frames in one buffer can be read in two calls.

Everything here is peer-controlled. content-length is bounded by max_frame_size and added with checked arithmetic, so it can neither wrap into a bogus offset nor address memory past the frame. An unterminated header block or body is refused once it passes the limit rather than buffered forever.

Errors

Returns CodecError if the command or headers are not UTF-8, a header is malformed, a NUL appears in the header block, content-length is unusable, the NUL terminator is missing, or the frame exceeds max_frame_size.