Heap out-of-bounds reads in libsmb2 QUERY INFO filesystem decoders

Two heap out-of-bounds reads in the QUERY INFO (FILESYSTEM) reply decoders (lib/smb2-data-filesystem-info.c), reached from smb2_process_query_info_variable() with vec pointing straight into the received PDU. Each reads an attacker-controlled 32-bit length from the reply and feeds length/2 UTF-16 units to smb2_utf16_to_utf8() (unicode.c), which walks that many units off the buffer with no bound against vec->len. smb2_get_uint32 is bounds-checked but its return value is ignored. Attacker = a malicious SMB server. The sibling decoders (fs_size_info, fs_device_info) already gate on vec->len — these two are the outliers.

• smb2_decode_file_fs_volume_info — sink at :71, no vec->len check at all. Fix: require vec->len >= 18 and reject volume_label_length > vec->len - 18.
• smb2_decode_file_fs_attribute_info — sink at :190, guards vec->len < 20 only. Fix: reject name_len > vec->len - 12.

Same family as the disclosed NTLM CHALLENGE over-read; intended to bundle to the maintainer with the other libsmb2 findings. ASan-confirmed with PoCs and a verified fix; disclosure pending.