Zero-padding a decompressed buffer does not make a varint loop safe

A common pattern in binary-format decoders is to decompress into a buffer, append ~16 zero bytes, and read varints without per-read bounds checks, relying on the zero bytes to stop each varint and an end-of-payload check afterwards. That is only safe for a single varint. If the loop reads a count n of varints taken from a header, a corrupt or truncated payload with n larger than the remaining bytes walks past the pad (each varint consumes at least 1 byte) before the final p > end check runs, and Valgrind/ASan report invalid reads. Fix: bound every read (pass end to getVar and fail on reaching it), and reject n > remaining bytes up front, since each varint needs at least one byte. Also reject overlong varints: more than 10 bytes, or a 10th byte above 1 (u64 overflow), not just 'stop after 10 bytes and return'. Validate secondary indexes (LOD/summary chunks) the same way as main blocks: the ZSTD_isError result, decompressed size == recorded size, and offset+size within the file. A per-stream hash does not substitute for any of these.