fix(fseq): never read a frame into an UncompressedFrameData whose malloc failed

UncompressedFrameData's constructor does `m_data = (uint8_t*)malloc(sz)` and
does not check the result. readFrame() tests m_data for null, but none of the
five getFrame() implementations that fill the buffer do: they go straight to
`read(&data->m_data[sz], toRead)` or `memcpy(data->m_data, ...)`. When the
allocation fails, the read path becomes fread(NULL, 1, N, fp), which faults
inside glibc's own buffer copy - a memcpy crash with no FPP frame below it,
which is exactly the shape that makes these reports hard to bucket.

This is reachable, not theoretical. A channel range whose start lies past the
end of the sequence turns m_dataBlockSize into a ~4GB request; the range guard
in V1FSEQFile::prepareRead keeps master out of that particular hole, but the
allocation can still fail for its own reasons on a 512MB controller, and four
of the five call sites are in the V2 handlers, which compute the size their
own way.

Add one guard used by all five sites: log the size that could not be allocated
and hand the frame back untouched. Returning the object rather than nullptr
matches the existing early-exit paths in these functions, and readFrame()
already reports false for a null buffer, so callers see a frame that did not
load instead of a daemon that died.

Verified with a standalone harness that builds FSEQFile.cpp on its own and runs
it under a capped address space so malloc genuinely fails. The control fails
first: the same harness against a tree without the range guard segfaults inside
fread with buf=0x0, and with this change it logs the failed allocation and
returns a frame that readFrame() rejects.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: dkulp

src/fseq/FSEQFile.cpp

@@ -728,6 +728,19 @@ class UncompressedFrameData : public FSEQFile::FrameData {
     std::vector<std::pair<uint32_t, uint32_t>> m_ranges;
 };
 
+// A frame whose channel buffer could not be allocated is handed back untouched:
+// readFrame() already reports false for a null buffer, whereas the read/memcpy
+// paths below would write through it.  malloc() failing here is not hypothetical --
+// a channel range that starts past the end of the sequence turns m_dataBlockSize
+// into a multi-gigabyte request, which no controller can satisfy.
+static bool frameBufferAllocated(const UncompressedFrameData* data, uint32_t frame, uint32_t sz) {
+    if (data->m_data != nullptr) {
+        return true;
+    }
+    LogErr(VB_SEQUENCE, "Failed to allocate %u bytes of channel data for frame %d\n", sz, (int)frame);
+    return false;
+}
+
 void V1FSEQFile::prepareRead(const std::vector<std::pair<uint32_t, uint32_t>>& ranges, uint32_t startFrame) {
     m_rangesToRead.clear();
     m_dataBlockSize = 0;
@@ -767,6 +780,9 @@ FrameData* V1FSEQFile::getFrame(uint32_t frame) {
     offset += m_seqChanDataOffset;
 
     UncompressedFrameData* data = new UncompressedFrameData(frame, m_dataBlockSize, m_rangesToRead);
+    if (!frameBufferAllocated(data, frame, m_dataBlockSize)) {
+        return data;
+    }
     if (seek(offset, SEEK_SET)) {
         LogErr(VB_SEQUENCE, "Failed to seek to proper offset for channel data for frame %d! %" PRIu64 "\n", frame, offset);
         return data;
@@ -885,6 +901,9 @@ class V2NoneCompressionHandler : public V2Handler {
     }
     virtual FrameData* getFrame(uint32_t frame) override {
         UncompressedFrameData* data = new UncompressedFrameData(frame, m_file->m_dataBlockSize, m_file->m_rangesToRead);
+        if (!frameBufferAllocated(data, frame, m_file->m_dataBlockSize)) {
+            return data;
+        }
         uint64_t offset = m_file->getChannelCount();
         offset *= frame;
         offset += m_seqChanDataOffset;
@@ -1509,6 +1528,9 @@ class V2ZSTDCompressionHandler : public V2CompressedHandler {
         }
         BulkSlot* b = bulkGetBlock(block);
         UncompressedFrameData* data = new UncompressedFrameData(frame, m_file->m_dataBlockSize, m_file->m_rangesToRead);
+        if (!frameBufferAllocated(data, frame, m_file->m_dataBlockSize)) {
+            return data;
+        }
         if (b == nullptr) {
             LogErr(VB_SEQUENCE, "Failed to get block %d for frame %d\n", (int)block, (int)frame);
             return data;
@@ -1579,6 +1601,9 @@ class V2ZSTDCompressionHandler : public V2CompressedHandler {
             m_curFrameInBlock = 0;
         }
         UncompressedFrameData* data = new UncompressedFrameData(frame, m_file->m_dataBlockSize, m_file->m_rangesToRead);
+        if (!frameBufferAllocated(data, frame, m_file->m_dataBlockSize)) {
+            return data;
+        }
 
         uint32_t blockStart = m_file->m_frameOffsets[m_curBlock].first;
         uint64_t frameEnd = frame < blockStart ? 0 : ((uint64_t)(frame - blockStart) + 1) * m_file->getChannelCount();
@@ -1807,6 +1832,9 @@ class V2ZLIBCompressionHandler : public V2CompressedHandler {
             m_stream = nullptr;
         }
         UncompressedFrameData* data = new UncompressedFrameData(frame, m_file->m_dataBlockSize, m_file->m_rangesToRead);
+        if (!frameBufferAllocated(data, frame, m_file->m_dataBlockSize)) {
+            return data;
+        }
 
         uint32_t blockStart = m_file->m_frameOffsets[m_curBlock].first;
         uint64_t frameEnd = frame < blockStart ? 0 : ((uint64_t)(frame - blockStart) + 1) * m_file->getChannelCount();