fix(nap_pmp): reject buffers that are too short on responses (#34)

## Description
Fixes a panic in decoding a response from the nat box due to incorrect
buffer size verifications. We were checking that the buffer size is
within range for all different kinds of responses, but for the specific
map response the buffer size is exact.

Also updates son libraries due to advisories
## Notes & open questions
<!-- Any notes, remarks or open questions you have to make about the PR.
-->
## Change checklist
- [x] Self-review.
- [x] Documentation updates following the [style
guide](https://rust-lang.github.io/rfcs/1574-more-api-documentation-conventions.html#appendix-a-full-conventions-text),
if relevant.
- [x] Tests if relevant.
- [x] All breaking changes documented.

Author: divagant-martian

Cargo.lock

@@ -115,7 +115,11 @@ impl Response {
     pub const RESPONSE_INDICATOR: u8 = 1u8 << 7;
 
     /// Decode a map response.
-    fn decode_map(buf: &[u8], proto: MapProtocol) -> Response {
+    fn decode_map(buf: &[u8], proto: MapProtocol) -> Result<Self, Error> {
+        if buf.len() != Self::MAX_SIZE {
+            return Err(MalformedSnafu.build());
+        }
+
         let epoch_bytes = buf[4..8].try_into().expect("slice has the right len");
         let epoch_time = u32::from_be_bytes(epoch_bytes);
 
@@ -128,13 +132,13 @@ impl Response {
         let lifetime_bytes = buf[12..16].try_into().expect("slice has the right len");
         let lifetime_seconds = u32::from_be_bytes(lifetime_bytes);
 
-        Response::PortMap {
+        Ok(Response::PortMap {
             proto,
             epoch_time,
             private_port,
             external_port,
             lifetime_seconds,
-        }
+        })
     }
 
     /// Decode a response.
@@ -176,8 +180,8 @@ impl Response {
                     public_ip: ip_bytes.into(),
                 }
             }
-            Opcode::MapUdp => Self::decode_map(buf, MapProtocol::Udp),
-            Opcode::MapTcp => Self::decode_map(buf, MapProtocol::Tcp),
+            Opcode::MapUdp => Self::decode_map(buf, MapProtocol::Udp)?,
+            Opcode::MapTcp => Self::decode_map(buf, MapProtocol::Tcp)?,
         };
 
         Ok(response)